removed apikey_revoke because it's handled by apikey_update