Similar to the work we recently did for the Invalidate Tokens API , we should aim to return consistent response bodies and status codes for calls to the Invalidate API Keys API. My initial thinking is that we should reuse the decisions made there and outlined in the PR description unless we have reasons to differentiate.