The same inactivity policy applies to API keys used by hirers and agencies. A daily check automatically revokes keys after 90 days without use. For a key that has never been used, the period starts at creation. A configured expiry date can end access sooner.

​

The key owner receives an email warning at least seven days before automatic inactivity revocation. Use the key if the integration is still required. Using it resets the inactivity window. Keys already overdue receive a full seven-day warning period before automatic revocation.

The owner also receives a revocation email through the daily notification check. Revoked keys cannot authenticate API requests. Contact your administrator to review access or arrange a replacement.

​

Reinstatement starts a fresh 90-day inactivity window and preserves the actual last-used date. Revocation and reinstatement history is retained, including the recorded reason, date and actor where available. Keys with lifecycle history cannot be deleted; revoke them when no longer needed.