the agent's api key was revoked mid-campaign and its url-reputation lookups failed

TL;DR

A revoked key is a provider decision: it may follow abuse detection, a billing problem, a leaked key, or an admin rotation nobody told the agent team about. Do not work around it with another key from a drawer. Find out why it was revoked from the provider account, fix that cause, get a legitimately issued replacement into the vault, and meanwhile run triage on detonation and other signals so the campaign is not undefended.

the agent's api key was revoked mid-campaign and its url-reputation lookups failed

Use this when

• Reputation lookups fail with key invalid or revoked errors for every URL.
• The provider account shows the key disabled or deleted.

Not for this skill when

• Lookups fail with quota errors that reset on a cycle. That is plan capacity, handled by pacing or upgrade.
• One endpoint rejects the key while others accept it. That is endpoint authorisation, not revocation.

Steps

1. Check the provider account or console for the key status and any notice about the revocation. Verify: the stated reason, if any, is recorded.
2. Check internally whether a rotation or offboarding removed the key deliberately. Verify: internal and provider explanations agree, or the discrepancy is escalated.
3. Resolve the cause, then issue a new key through the account owner and store it only in the vault, updating the agent reference. Verify: a test lookup succeeds with the new key.
4. Configure the agent to treat key failure as a degraded mode: continue triage with detonation and cached verdicts, and banner the gap in its reports. Verify: a simulated key failure produces degraded, not halted, triage.
5. Audit where the old key was used or stored, in case leakage caused the revocation. Verify: any exposed copies are removed and the case notes the finding.

Variant phrasings

api key revoked url reputation lookups fail campaign

The revoked key variant.

agent degraded mode reputation service unavailable triage

The degraded mode variant.

Compatibility: Commercial URL reputation services and their account key management, agent vault integration.

Why it happens

Keys get revoked at the worst moment because campaigns stress every limit and process at once. The technical fix is a new key; the real fix is knowing why, since a key revoked for leakage will be revoked again if the leak path stays open.

Edge cases / pitfalls

• One key per agent and purpose limits blast radius and makes revocation diagnosable.
• Never commit keys to the agent codebase or logs; leakage through logs is a common revocation cause.
• Keep a second independent verdict source warm so one provider action cannot blind triage.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstPtU6V4P57NoeMyRPyQbbw