Skip to content
tcpsystems
Version: Current

GET and POST /v1/keys

Part of the API reference; this page is generated from the OpenAPI document that the gateway builds from its own route tables.

Provenance

Section titled “Provenance”
  • Contract version: 1.10.0
  • Contract title: acumen gateway API
  • Source: acumen:docs/openapi/acumen-v1.openapi.json

Operations

Section titled “Operations”

GET /v1/keys

Section titled “GET /v1/keys”

List virtual keys

Every virtual key with its id, label, fingerprint, model allow-list and state. No token material is ever returned. Operator (admin) scope.

  • Operation id: getV1Keys
  • Scope: admin
  • Exposure: operator
  • Mutating: no
  • Auth: bearerAuth, operatorSession

Responses

  • 200: OK
    • application/json: KeyTable: KeyTable (object)
  • 400: schema_invalid — the request body or parameter failed validation
    • application/problem+json: Problem: Problem (object)
  • 401: auth_missing — no virtual key or operator session
    • application/problem+json: Problem: Problem (object)
  • 403: auth_scope — the credential lacks the route’s scope
    • application/problem+json: Problem: Problem (object)
  • 404: resource_not_found — the addressed object does not exist
    • application/problem+json: Problem: Problem (object)
  • 405: method_not_allowed — the path exists for another verb
    • application/problem+json: Problem: Problem (object)
  • 429: rate_limited — the per-key or per-IP bucket is exhausted
    • application/problem+json: Problem: Problem (object)
  • 500: internal — the store or process failed
    • application/problem+json: Problem: Problem (object)
  • 501: not_implemented — the route is declared but not wired in this build
    • application/problem+json: Problem: Problem (object)
  • 503: store_unavailable — the dependency is down; retryable
    • application/problem+json: Problem: Problem (object)

POST /v1/keys

Section titled “POST /v1/keys”

Mint a virtual key

Creates a virtual key with a label, an optional model allow-list and optionally restricted scopes. The plaintext token is returned once, in the 201 body, and never again. Operator (admin) scope. Honours Idempotency-Key.

  • Operation id: postV1Keys
  • Scope: admin
  • Exposure: operator
  • Mutating: yes
  • Auth: bearerAuth, operatorSession

Request

  • Request body (application/json, required): KeyCreateRequest: KeyCreateRequest (object)
Field Type Required Notes
label string yes
models array of string no
scopes array of string no

Responses

  • 201: created; the plaintext token appears once
    • application/json: KeyCreated: KeyCreated (object)
  • 400: schema_invalid — the request body or parameter failed validation
    • application/problem+json: Problem: Problem (object)
  • 401: auth_missing — no virtual key or operator session
    • application/problem+json: Problem: Problem (object)
  • 403: auth_scope — the credential lacks the route’s scope
    • application/problem+json: Problem: Problem (object)
  • 404: resource_not_found — the addressed object does not exist
    • application/problem+json: Problem: Problem (object)
  • 405: method_not_allowed — the path exists for another verb
    • application/problem+json: Problem: Problem (object)
  • 429: rate_limited — the per-key or per-IP bucket is exhausted
    • application/problem+json: Problem: Problem (object)
  • 500: internal — the store or process failed
    • application/problem+json: Problem: Problem (object)
  • 501: not_implemented — the route is declared but not wired in this build
    • application/problem+json: Problem: Problem (object)
  • 503: store_unavailable — the dependency is down; retryable
    • application/problem+json: Problem: Problem (object)