POST /api/admin/accounts/:sub/cloud/keys/:keyId/revoke (keys.revoke: owner/support, step-up, X-Admin-Reason; §8) → {keyId, revoked, managedBy}.Staff cookie session; permission keys.revoke; fresh password + TOTP step-up (10 minutes); X-Admin-Reason required (3–300 characters). Write requests need same-origin JSON and X-Admin-CSRF from this session.Source snapshot: admin/src/app/api/admin/accounts/[sub]/cloud/keys/[keyId]/revoke/route.ts. This reference describes the current working tree, not proof of deployment. The response service types and validators remain authoritative.