API keys

3 operations at https://api.zaitrack.app. Request and response bodies are JSON with camelCase keys; ids are UUIDs; times are RFC 3339 in UTC.

Keys are made in Developer Studio or, live keys, in the console under Team → New API key; the API lists, rotates and revokes them.

Every operation needs an API key, a personal access token or an OAuth access token unless it says otherwise. An Idempotency-Key is replayed for 24 hours; see Idempotency. Errors are application/problem+json; see Errors.

The organisation's API keys (no secrets)

GET /v1/api-keys

The API has no call to create a key: keys are made in Developer Studio, which bounds a new key's scopes by yours. Secrets are never listed.

• Scope: tenancy:read or tenancy:*
• Rate class: read (100 per second and 360,000 per hour)
• Idempotency-Key: not used
• Audited: no
• Step-up MFA: no

Query parameter	Type	Notes
devTenantId	string

Request

No body.

Response

200: fields the handler writes, taken from its source.

Field	Type	Notes
apiKeys	array of object
apiKeys[].id	string
apiKeys[].kind	string
apiKeys[].devTenantId	string
apiKeys[].sandboxId	string	omitted when empty
apiKeys[].ownerUserId	string
apiKeys[].label	string
apiKeys[].prefix	string
apiKeys[].last4	string
apiKeys[].mode	string
apiKeys[].scopes	array of string
apiKeys[].ipAllowlist	array of string
apiKeys[].status	string
apiKeys[].createdAt	string
apiKeys[].expiresAt	string
apiKeys[].rotationAfterAt	string
apiKeys[].secret	string	omitted when empty

Example

curl "https://api.zaitrack.app/v1/api-keys" \
  -H "Authorization: Bearer zk_test_…"

Rotate a key (the new secret is shown once)

POST /v1/api-keys/{id}:rotate

Rotation keeps the key's scopes. The new secret is in the response once.

• Scope: tenancy:write or tenancy:*
• Rate class: credentials (10 per minute)
• Idempotency-Key: optional
• Audited: high risk
• Step-up MFA: no

Path parameters: id.

Request

No body: the handler reads none.

Response

200: fields the handler writes, taken from its source.

Field	Type	Notes
id	string
kind	string
devTenantId	string
sandboxId	string	omitted when empty
ownerUserId	string
label	string
prefix	string
last4	string
mode	string
scopes	array of string
ipAllowlist	array of string
status	string
createdAt	string
expiresAt	string
rotationAfterAt	string
secret	string	omitted when empty

Example

curl -X POST "https://api.zaitrack.app/v1/api-keys/$ID:rotate" \
  -H "Authorization: Bearer zk_test_…" \
  -H "Idempotency-Key: $(uuidgen)"

Revoke a key

POST /v1/api-keys/{id}:revoke

• Scope: tenancy:write or tenancy:*
• Rate class: credentials (10 per minute)
• Idempotency-Key: optional
• Audited: high risk
• Step-up MFA: no

Path parameters: id.

Request

No body: the handler reads none.

Response

200: fields the handler writes, taken from its source.

The same fields as the response of Rotate a key (the new secret is shown once).

Example

curl -X POST "https://api.zaitrack.app/v1/api-keys/$ID:revoke" \
  -H "Authorization: Bearer zk_test_…" \
  -H "Idempotency-Key: $(uuidgen)"