# Deactivate a global integrator for the current tenant Immediately revoke this tenant's API key for a global…

`POST /api/configuration/operator/integrators/{id}/deactivate`

- **Products:** Operator (`FOH`)
- **Features:** Front of House Generic Access (`FOHGENERIC`)

HTML version: [Deactivate a global integrator for the current tenant Immediately revoke this tenant's API key for a global…](https://support.gladstonesoftware.cloud/reference/configuration/deactivate-a-global-integrator-for-the-current-tenant-immediately-revoke-this-te)

## Overview

Revokes the one API key this tenant holds for a global integrator, ending that integration's access. Nothing is deleted: the integrator itself is untouched, its `isActive` flag is not changed, and it stays in the catalogue returned by [List global integrators with tenant activation status](list-global-integrators-with-tenant-activation-status-get-every-global-integrato.md) — it simply shows as not activated, with no `activeKeyPrefix`.

Exactly one key is affected: the one matching this integrator, this tenant's environment, a status of `Active`, and either no expiry or an expiry still in the future. Its status becomes `Revoked`, the revocation time is recorded, and the change is attributed to `system-deactivate`. Keys other tenants hold for the same global integrator carry a different environment id and are not touched.

**What stops working, and what does not.** The revoked key can no longer obtain tokens from `POST /api/samlauthentication/partner/token` — see [API Key Authentication](../../guides/api-key-authentication.md). That includes the refresh flow, because refreshing also requires the `X-Partner-Api-Key` header. **Access tokens already issued keep working.** Revoking the key does not invalidate a JWT that has already been handed out, so an integration mid-session continues to call the API until its current token reaches the `expiresIn` it was issued with, and only then fails to refresh.

**Revocation is not instant.** For a short period after the call the old key can still obtain tokens — typically anywhere from 4 to 120 seconds in Gladstone's own testing, and up to five minutes in the worst case. Do not treat a `204` as proof the key is already dead.

**Calling it twice is a `204`, not a `404`.** When no active key remains the call does nothing and still answers `204 No Content` with an empty body. A `404` means the id itself is wrong — either no integrator has that id, or the id belongs to a private integrator.

**It is reversible, but not by restoring the old key.** [Activate a global integrator](activate-a-global-integrator-for-the-current-tenant-issue-a-fresh-api-key-agains.md) issues a brand-new key and returns its plaintext value once; the revoked key stays revoked permanently and its plaintext is never recoverable. Re-activation also sets the integrator's `isActive` back to `true` if it had been cleared. Plan for the re-key: every deactivate/activate cycle forces the integration to be updated with a new secret.

This endpoint is tenant-scoped and is the one you want for withdrawing your own tenant from an integration. It is not the same as [Soft-delete a global integrator](soft-delete-a-global-integrator-mark-a-global-integrator-inactive-without-removi.md), which is the platform-wide administrative call and disables the integrator for every tenant at once.

## Endpoint

`POST {base_url}/api/configuration/operator/integrators/{id}/deactivate`

`{base_url}` is the environment URL issued to your integration. See [Authenticating with Gladstone APIs](../../guides/authenticating-with-gladstone-apis.md).

## Path parameters

| Name | Type | Required | Description |
|------|------|----------|-------------|
| `id` | integer (int32) | Yes | The global integrator to withdraw from, matching the `id` returned by [List global integrators with tenant activation status](list-global-integrators-with-tenant-activation-status-get-every-global-integrato.md). It identifies the integrator, not the API key — you never send a key to this endpoint. Integers only: a non-numeric value returns `404`. Passing the id of a private integrator also returns `404`, because the integrator must be global. |

## Sample request

```bash title="cURL"
curl -X POST '{base_url}/api/configuration/operator/integrators/{id}/deactivate' \
  -H 'Authorization: Bearer {accessToken}' \
  -H 'X-Use-SSO: true'
```

## Errors

| Status | Meaning | When |
|--------|---------|------|
| `400` | Bad request | The tenant environment you are calling for could not be determined, and the endpoint answers with the plain-text string `Could not resolve tenant environment.` The environment is taken from your token, so this points at the token rather than at anything in your request. Nothing is revoked. |
| `404` | Not found | No integrator exists with the supplied `id`. The response body is empty. |
| `404` | Not found | The `id` exists but belongs to a private integrator. This endpoint only accepts global integrators; use [Revoke a private integrator's API key](revoke-a-private-integrators-api-key-immediately-invalidate-the-active-api-key-f.md) for a private one. |
| `500` | Internal server error | An unexpected server-side failure while reading the integrator or revoking the key. The body is empty. A failure part-way can leave the key revoked but still briefly usable — re-read the integrator's activation status before retrying rather than assuming the call did nothing. |
| `503` | Service unavailable | The platform was temporarily unavailable and the request was not processed, so no key was revoked and the call is safe to retry. |