API Keys

Creates a Project-scoped runtime API key. Any effective Project role may create a personal key for themselves - ownerUserId can never be supplied; it's always the authenticated caller. Only effective Project admin may create a shared key. Rejected with 409 if the Space's max_api_keys plan limit is already reached.

{
  "name": "CI shared key",
  "ownership": "shared",
  "permission": "read"
}

{
  "id": 1,
  "name": "CI shared key",
  "ownership": "shared",
  "permission": "read",
  "apiKey": "",
  "createdAt": "2026-01-01T00:00:00.000Z"
}

Returns key metadata, including the full apiKey secret - this is a testing/mock-data platform, not a production credential store, so keys stay visible after creation rather than only showing a hash-backed prefix. An effective Project admin sees every key; an editor/viewer sees every shared key plus only their own personal keys. Revoked keys are omitted. apiKey is null for a key created before this field existed, since its plaintext was never stored.

{
  "apiKeys": [
    {
      "id": 1,
      "name": "My personal key",
      "ownership": "personal",
      "owner": {
        "id": 1001,
        "name": "Jane Doe",
        "email": "jane@example.com"
      },
      "permission": "read_write",
      "prefix": "a1B2c3D4",
      "apiKey": "a1B2c3D4-full-raw-secret",
      "createdAt": "2026-01-01T00:00:00.000Z"
    },
    {
      "id": 2,
      "name": "CI shared key",
      "ownership": "shared",
      "permission": "read",
      "prefix": "x9Y8z7W6",
      "apiKey": "x9Y8z7W6-full-raw-secret",
      "lastUsedAt": "2026-01-02T00:00:00.000Z",
      "createdAt": "2026-01-01T00:00:00.000Z"
    }
  ]
}

Revokes the key immediately (soft-delete - the row is kept for audit history, but a revoked key is invisible to GET and can never be reset again) and deletes its runtime dataset instance, if one exists. A user may revoke their own personal key; a shared key or someone else's personal key requires effective Project admin. Future Runtime API requests using this key return 401. Does not affect the Project's master template or any other key's dataset.

Discards the key's current mutable runtime dataset and replaces it with a fresh copy of the Project's active master template - a predictable way to restore test data without regenerating or touching the template itself. Same permission rule as revoke. Returns 409 if the Project has never generated a template (there's nothing to copy from). Has no effect on any other key's dataset.

{
  "apiKeyId": 2,
  "resetAt": "2026-01-01T00:00:00.000Z"
}