v171

latestOpenAPI 3.1.0raw.githubusercontent.com2026-08-0726249111.7 MB

API keys

Create a new API key

Mints a new opaque API key (sk-orq-<key_id>-<secret>) in the workspace. The raw secret is returned ONCE in the response and is never retrievable afterwards. The stored record retains only token_prefix and a SHA-256 token_hash.

post/v2/api-keys

Request body

namestring required

Human-readable name. Required.

permission_mode'PERMISSION_MODE_UNSPECIFIED' | 'PERMISSION_MODE_ALL' | 'PERMISSION_MODE_RESTRICTED' | 'PERMISSION_MODE_READ_ONLY'

accessobject

Per-domain access map. Required when permission_mode = PERMISSION_MODE_RESTRICTED. See ApiKey.access for the full catalog of valid keys (Domain.id) and AccessLevel string values, or fetch the live catalog via the capability catalog endpoint.

expires_atstring date-time

Optional expiration. When set, the authenticate hot-path rejects the key once expires_at is in the past. Unset means the key never expires.

Response

API key created successfully.

idstring required

namestring required

workspace_idstring required

tokenstring required

Raw on create/retrieve and masked in list responses.

activeboolean

is_legacyboolean

sourcestring

budgetobject

expirationstring date-time

projectsstring[]

created_by_idstring nullable

updated_by_idstring nullable

createdstring date-time

updatedstring date-time

consumptionnumber

token_consumptionnumber

requests_per_minute_consumptionnumber

ownerobject

project_scopeobject

permission_modestring

accessobject

token_prefixstring

statusstring

constraintsobject

mcp_accessobject

legacy_token_familystring

legacy_key_idstring

last_used_atstring date-time