1. API Reference
  3. API resources
  5. API keys
Website
  • API overview
  • API quickstart
  • Authentication
  • Project scoping
  • Requests and responses
  • Pagination and filtering
  • Errors
  • GETList supported database engines
  • POSTList projects
  • POSTCreate a project
  • GETGet a project
  • DELETEDelete a project
  • PATCHUpdate a project
  • POSTCreate a source
  • POSTList sources
  • GETGet source details
  • DELETEDelete a source
  • PATCHUpdate a source
  • POSTCreate secret metadata
  • POSTList secret metadata
  • GETGet secret metadata
  • DELETEDelete secret metadata
  • PATCHUpdate secret metadata
  • POSTCreate a schedule
  • POSTList schedules
  • POSTSummarize schedule statuses
  • GETGet a schedule
  • DELETEDelete a schedule
  • PATCHUpdate a schedule
  • DELETERemove a schedule gate
  • POSTActivate or pause a schedule
  • POSTQueue a manual check
  • POSTCreate an immutable report
  • POSTList reports
  • GETGet report details
  • DELETEDelete a report
  • POSTDownload a report
  • POSTGet the API-key scope catalog
  • POSTCreate an API key
  • POSTList API-key metadata
  • GETGet API-key metadata
  • DELETEDelete an API key
  • PATCHUpdate API-key metadata
  • POSTCreate a notification channel
  • POSTList notification channels
  • POSTResolve notification channels by ID
  • GETGet notification channel details
  • DELETEDelete a notification channel
  • PATCHUpdate a notification channel
  • POSTSend a test notification
  • POSTCreate a project worker
  • POSTList project workers
  • GETGet worker details
  • DELETEDelete a worker
  • PATCHUpdate a worker
  • POSTRead live worker agent logs
  • POSTList checks
  • POSTSummarize check statuses
  • GETGet check details
  • POSTGet check log sections
  • POSTDownload a check log
  • POSTDownload check audit evidence
  • POSTList notification messages
  • GETGet notification message details

API keys

Create project-bound credentials in the console and safely manage their metadata and lifecycle.

Loading documentation…

Workers< PreviousList supported database enginesNext >

Powered by heyo

On this page

Creation boundaryManage existing keys

API keys are project-bound credentials for unattended automation. Each key has an expiration date and explicit scopes.

The secret is returned once

Only the create response contains the plaintext api_key. Later list and detail responses return metadata only. Store the value immediately or replace the key.

Creation boundary

Create API key requires an interactive console session. An API key cannot create another key, even if it has v1.api-keys:write.

The create request includes:

  • project_id
  • name and optional description
  • at least one valid scope
  • expires_on as YYYY-MM-DD, no more than three years in the future

Manage existing keys

An API key with the relevant API-key scope can:

  • discover valid scopes with Get scope catalog
  • list key metadata
  • get key metadata
  • update name, description, or status
  • delete a key

Scopes and expiration cannot be changed after creation. Create a replacement key instead. Setting status to paused invalidates the key for authentication.

Avoid self-lockout

If a key updates or deletes API-key metadata, make sure another authorized credential remains available before pausing or deleting the calling key.

Related topics

  • Review the complete scope catalog
  • Follow project-scoping rules
  • Interpret credential failures