Remotehost Docs
API ReferenceAPI keys

Revoke an API key

DELETE
/orgs/{orgId}/api-keys/{keyId}

Requires a user session with api_keys.manage. API keys cannot call this operation. A sandbox's own Claims key (rh_sb_) cannot be revoked by hand: it answers 409 with code: "sandbox_key_managed". To stop a sandbox using Claims, delete the sandbox or revoke the key it was issued from.

Authorization

bearerAuth
AuthorizationBearer <token>

A RemoteHost API key (rh_sk_...) or a user session token.

In: header

Path Parameters

orgId*string
keyId*string

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

curl -X DELETE "https://example.com/orgs/string/api-keys/string"
{  "ok": true}

Rotate an API key POST

Mints a successor with the same name, scopes and lifetime, and ends the old key after `overlapHours` (default 24, at most 168; 0 ends it now). The old key's new expiry is stored on it and returned. Only the key's creator may rotate it; API keys cannot call this operation. A sandbox's own Claims key (`rh_sb_`) is managed by RemoteHost and answers 409 with `code: "sandbox_key_managed"`. A workspace-pinned key's successor keeps the pin, and its scopes are checked again against what its principal holds in that workspace (403 `scope_exceeds_maker` otherwise).

Browse RemoteHost's add-ons GET

RemoteHost's own and reviewed add-ons (provenance `first_party` or `verified`) that are listed: what a signed-out marketplace shows. Needs no credential and reads none, so the answer is the same for everyone and carries nothing about any org. Cacheable (`Cache-Control: public`, an ETag); rate limited per address.