API reference

API keys

4 endpoints under /v1/api-keys.

api keys programmatic

Create Api Key Programmatic

post/v1/api-keys

Mint a new API key from the public API. Requires API-key auth; JWT requests are refused. The parent key must hold keys:write and the org must have programmatic_api_keys_enabled. New scopes must be a subset of the parent's and must not include keys:write. The per-tier max_api_keys and max_scopes_per_key caps apply.

Headers

X-Organization-IDstringoptional

Request body

namestringrequired
scopesstring[]required
is_test_modebooleanoptional
workspace_idstring (uuid)optional

Failures return the error envelope; branch on error_code.

Request

Response

organizations

List Api Keys

get/v1/api-keys

List the caller's own API keys (org-bound).

Headers

X-Organization-IDstringoptional

Failures return the error envelope; branch on error_code.

Request

Response

Revoke Api Key

post/v1/api-keys/{key_id}/revoke

Revoke an API key. Idempotent: an already-revoked key is returned with revoked_at set.

Path parameters

key_idstring (uuid)required

Headers

X-Organization-IDstringoptional

Failures return the error envelope; branch on error_code.

Request

Response

List Api Key Scopes

get/v1/api-keys/scopes

List every OAuth scope a customer API key may carry.

Headers

X-Organization-IDstringoptional

Failures return the error envelope; branch on error_code.

Request

Response