Skip to main content
Manage API keys programmatically. All three endpoints require the control:read scope.

List API keys

Returns all non-revoked keys for your org, cursor-paginated.

Query parameters

Response

The full token is never returned after creation.

Create an API key

Body

Valid scopes: ai:chat, ai:documents, ai:embeddings, ai:summarize, control:read, control:webhooks

Response (201)

data.plaintext is the full token. This is the only time it is returned. Copy it immediately — HASP stores only the hash.

Revoke an API key

Revocation is immediate. Any in-flight request using the revoked key will fail on the next middleware check. Keys belonging to a different org return 404.

Response


Error codes