Create an API key and reveal its secret once
Requires an explicitly delegated key:manage capability whose creator is still an organization owner or admin. Callers carrying any spend bounds cannot create keys: delegation must not multiply a rolling budget. An unbounded management key may grant requested scopes, including priced scopes with finite per-request and rolling-budget bounds. Child expiry cannot exceed the caller's expiry. A restricted caller must grant an explicit subset of its Operation allowlist and cannot delegate key:manage. Null allowedOperations permits every Operation allowed by scopes; [] permits none. The secret is returned only on initial success and is never persisted in the idempotency receipt. Replays return 409; revoke the created key and use a new request if the secret was lost. Free.
Requires an explicitly delegated key:manage capability whose creator is still an organization owner or admin. Callers carrying any spend bounds cannot create keys: delegation must not multiply a rolling budget. An unbounded management key may grant requested scopes, including priced scopes with finite per-request and rolling-budget bounds. Child expiry cannot exceed the caller's expiry. A restricted caller must grant an explicit subset of its Operation allowlist and cannot delegate key:manage. Null allowedOperations permits every Operation allowed by scopes; [] permits none. The secret is returned only on initial success and is never persisted in the idempotency receipt. Replays return 409; revoke the created key and use a new request if the secret was lost.
Free.
Authorization
bearerAuth In: header
Header Parameters
Required for writes. Reusing this key with the same input replays the original response.
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/api/v1/keys" \ -H "Idempotency-Key: string" \ -H "Content-Type: application/json" \ -d '{ "name": "Research agent", "scopes": [ "search:run" ], "expirationDays": 1, "budgetCredits": 100, "budgetPeriodDays": 1, "maxRequestCredits": 10, "allowedOperations": [ "search" ] }'{ "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "name": "string", "key": "string", "keyPrefix": "string", "expiresAt": "2019-08-24T14:15:22Z", "createdAt": "2019-08-24T14:15:22Z", "scopes": [ "commons:publish" ], "allowedOperations": [ "audit-calls" ], "budgetCredits": 0, "budgetPeriodDays": -9007199254740991, "maxRequestCredits": 0}Page a Job's frozen target list GET
The ordered Companies this Job was admitted over, with the watermarks it was computed under: the admission transaction's own time, and the Commons Generation this Job read for each Jurisdiction the Commons served. The list is frozen at admission: deleting a target, merging it into another Company, or changing the Segment that selected it never rewrites the receipt, so a target id here may no longer name a live Company. Free.
Revoke an organization API key POST
Requires key:manage and a creator who is still an organization owner or admin. The target must belong to the authenticated organization; missing and foreign keys both return 404. Revoking a recorded parent or transitive ancestor returns 403 key_ancestor_revocation_forbidden, including through revoked ancestors. Revoking an already revoked non-ancestor key succeeds without another policy event. Subsequent authentication with the revoked key is refused. Free.