v3

latestOpenAPI 3.1.0Proprietary2026-08-07266348629.6 KB

Project Keys

Enable Project Key Agentic

Toggle agentic use ON for a Project Key (the agentic toggle).

Atomic: rotates the API client credential, encrypts the new credential file blob with KMS, stores it on the PK row, sets agentic_enabled=True. Idempotent on already-enabled PKs (no double rotation).

Rate limit: 5/min/tenant (each call burns one Frontegg credential rotation). Returns 429 with Retry-After on bucket exhaustion.

Audit-logged with action=enable / enable_noop, actor email + sub, old/new state, tenant_id, project_key_id, timestamp.

post/project-keys/{project_key_id}/enable-agentic

Path parameters

project_key_idstring required

Response

Successful Response

idstring required

namestring required

descriptionstring nullable

created_atstring date-time nullable

api_client_idstring nullable

api_client_id_masked_secretstring nullable

kafka_usernamestring nullable

service_idstring required

statusstring required

last_used_atstring date-time nullable

tool_profile'full' | 'read-only' | 'agent-operator' | 'infra-admin'

allowed_toolsstring[] nullable

blocked_toolsstring[] nullable

agentic_enabledboolean

Whether this Project Key is wired up as the auth blob behind the Streamkap MCP. Toggled via POST /project-keys/{id}/enable-agentic and disable-agentic. When true, the encrypted credential lives on the PK row (server-side only); the agent picker on the FE filters to PKs where this is true.

agentic_secret_blobstring nullable

Always masked to '********' on responses when agentic_enabled is true; null otherwise. Server-derived only - PUT/PATCH bodies that include this field are rejected with 422.