## TL;DR
A revoked key is a provider decision: it may follow abuse detection, a billing problem, a leaked key, or an admin rotation nobody told the agent team about. Do not work around it with another key from a drawer. Find out why it was revoked from the provider account, fix that cause, get a legitimately issued replacement into the vault, and meanwhile run triage on detonation and other signals so the campaign is not undefended.

```text
the agent's api key was revoked mid-campaign and its url-reputation lookups failed
```

## Use this when
- Reputation lookups fail with key invalid or revoked errors for every URL.
- The provider account shows the key disabled or deleted.

## Not for this skill when
- Lookups fail with quota errors that reset on a cycle. That is plan capacity, handled by pacing or upgrade.
- One endpoint rejects the key while others accept it. That is endpoint authorisation, not revocation.

## Steps
1. Check the provider account or console for the key status and any notice about the revocation. Verify: the stated reason, if any, is recorded.
2. Check internally whether a rotation or offboarding removed the key deliberately. Verify: internal and provider explanations agree, or the discrepancy is escalated.
3. Resolve the cause, then issue a new key through the account owner and store it only in the vault, updating the agent reference. Verify: a test lookup succeeds with the new key.
4. Configure the agent to treat key failure as a degraded mode: continue triage with detonation and cached verdicts, and banner the gap in its reports. Verify: a simulated key failure produces degraded, not halted, triage.
5. Audit where the old key was used or stored, in case leakage caused the revocation. Verify: any exposed copies are removed and the case notes the finding.

## Variant phrasings
### api key revoked url reputation lookups fail campaign
The revoked key variant.
### agent degraded mode reputation service unavailable triage
The degraded mode variant.

Compatibility: Commercial URL reputation services and their account key management, agent vault integration.

## Why it happens
Keys get revoked at the worst moment because campaigns stress every limit and process at once. The technical fix is a new key; the real fix is knowing why, since a key revoked for leakage will be revoked again if the leak path stays open.

## Edge cases / pitfalls
- One key per agent and purpose limits blast radius and makes revocation diagnosable.
- Never commit keys to the agent codebase or logs; leakage through logs is a common revocation cause.
- Keep a second independent verdict source warm so one provider action cannot blind triage.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_PtU6V4P57NoeMy_RPyQbbw