Mint an organization-bound API key
Requires a user session with api_keys.manage. API keys cannot mint keys. Both choices are required: what the key may do (scopes, a template, or unscoped: true) and when it stops (expiresInDays or neverExpires: true); a request missing either is refused with 400. Scopes narrow the creator's permissions, and [] grants none. Store the returned token securely: it is shown only once.
Authorization
bearerAuth A RemoteHost API key (rh_sk_...) or a user session token.
In: header
Path Parameters
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
application/json
application/json
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/orgs/string/api-keys" \ -H "Content-Type: application/json" \ -d '{ "name": "string", "scopes": [ "string" ], "expiresInDays": 1 }'{ "apiKey": { "id": "string", "org_id": "string", "name": "string", "key_prefix": "string", "last_used_at": "string", "created_at": "string", "revoked_at": "string", "expires_at": "string", "scopes": [ "string" ], "created_by": "string", "workspace_id": "string" }, "token": "string"}List API key metadata GET
Requires a user session with api_keys.manage. API keys cannot call this operation. Secret tokens are never returned.
Rotate an API key POST
Mints a successor with the same name, scopes and lifetime, and ends the old key after `overlapHours` (default 24, at most 168; 0 ends it now). The old key's new expiry is stored on it and returned. Only the key's creator may rotate it; API keys cannot call this operation. A sandbox's own Claims key (`rh_sb_`) is managed by RemoteHost and answers 409 with `code: "sandbox_key_managed"`. A workspace-pinned key's successor keeps the pin, and its scopes are checked again against what its principal holds in that workspace (403 `scope_exceeds_maker` otherwise).