Die Beschreibungen der Operationen und Felder stammen aus dem Vertrag und sind auf Englisch.
/identity/v1/self/api-keysList the signed-in human's personal API keys
- Anmeldedaten
- Token einer angemeldeten Person (Console-Sitzung)
- Berechtigung
inference.read
Requires a verified human OIDC session, an active human identity and an active membership in the organization selected by trusted context. Returns only this caller's personal keys in that organization, ordered by key ID, without raw values or digests. Does not require inference.invoke or api-keys.manage, so a member who lost creation permission can still inspect their keys. API keys and bootstrap credentials are refused. A deleted key is not listed.
curl "https://console.eu.ccsio.ai/identity/v1/self/api-keys" \
-H "Authorization: Bearer $CCSIO_ACCESS_TOKEN"Parameter
| Name | In | Beschreibung |
|---|---|---|
X-Request-IDoptional | header | string Optional request ULID. A valid ULID (upper or lowercase) is honored; when the header is absent or invalid, the runtime mints the id. The response X-Request-ID header carries the canonical uppercase form. |
X-Organization-Idoptional | header | string Selects one of the authenticated human's active organization memberships. The server resolves and verifies this selection into trusted context; request bodies cannot choose the owner or organization. WeiterlesenA platform operator (a human whose user holds the active platform role ccsio_admin) may also select ANY existing organization: where they hold no membership the context carries only the platform operator permission set and no role bindings. For every other human, naming an organization they hold no active membership in is refused with 403 organization-not-selectable. |
Antworten
- 200
List the signed-in human's personal API keys.
Schema
ListAPIKeysResponseapi_keysarray of APIKeyPflichtkey_idstringPflichtThe platform-minted key id (uppercase ULID).
pattern ^[0-9A-HJKMNP-TV-Z]{26}$
org_idstringPflichtpattern ^[a-z][a-z0-9._-]{0,63}$
namestringPflicht1 to 128 characters
principal_refstringPflichtpattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$
prefixstringPflichtThe display prefix (ccsio_ plus the first 8 entropy characters) — never the raw value, never a digest.
pattern ^ccsio_[A-Za-z0-9_-]{8}$
created_bystringPflichtpattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$
created_atstring (date-time)PflichtRFC 3339, second precision, UTC.
expires_atstring (date-time) or nullPflichtRFC 3339, second precision, UTC; null when the key has no expiry.
statestringPflichtThe key state; revoked is terminal.
Erlaubte Werte:
"active""revoked"revoked_atstring (date-time) or nullPflichtRFC 3339, second precision, UTC; null while active.
kindstringPflichtThe persisted credential type; existing service-account keys retain service_account.
Erlaubte Werte:
"personal""service_account"ownerobjectoptionaldisplay_namestringPflichtReadable owner name from the identity profile.
emailstringoptionalOwner email when known; presentation only, never an authorization identifier.
kindstringPflichtErlaubte Werte:
"human""service_account"
- 400
Client refusal unrelated to authentication, including malformed input, a denied or failed request.
- 401
The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:
Weiterlesen
Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled
- 403
The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.
Weiterlesen
Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)
- 404
The requested resource or path was not found.
- 405
The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.
- 500
Platform failure, rendered without internal cause details.
/identity/v1/self/api-keysIssue a personal API key for the signed-in human
- Anmeldedaten
- Token einer angemeldeten Person (Console-Sitzung)
- Berechtigung
inference.invoke- Request-Body
- Body bis 1 MiB
Requires a verified human OIDC session, an active human identity, an active organization membership and current inference.invoke permission in the selected organization.
Weiterlesen
The server derives owner, creator and fixed organization from trusted context; principal_ref, created_by and org_id are not accepted. The personal key authorizes inference (the /v1/* surface) and the aggregated MCP endpoint (POST /mcp/) and never administrative control-plane operations; its use of the MCP endpoint additionally requires its owner to hold mcp.invoke in the organization. Every use rechecks the owner's active identity and membership; platform authority is never inherited. name is required (1–128 UTF-8 bytes). expires_at is optional RFC 3339; absent, null or an empty string means no expiry, and a value not after creation is refused with 400 api-key-invalid. The raw value is returned once at creation. Issuance is not idempotent; a repeated successful request creates another key.
curl -X POST "https://console.eu.ccsio.ai/identity/v1/self/api-keys" \
-H "Authorization: Bearer $CCSIO_ACCESS_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"name": "laptop"
}'Parameter
| Name | In | Beschreibung |
|---|---|---|
X-Request-IDoptional | header | string Optional request ULID. A valid ULID (upper or lowercase) is honored; when the header is absent or invalid, the runtime mints the id. The response X-Request-ID header carries the canonical uppercase form. |
X-Organization-Idoptional | header | string Selects one of the authenticated human's active organization memberships. The server resolves and verifies this selection into trusted context; request bodies cannot choose the owner or organization. WeiterlesenA platform operator (a human whose user holds the active platform role ccsio_admin) may also select ANY existing organization: where they hold no membership the context carries only the platform operator permission set and no role bindings. For every other human, naming an organization they hold no active membership in is refused with 403 organization-not-selectable. |
Request-Body application/json
namestringPflichtReadable key name, 1–128 UTF-8 bytes.
1 to 128 characters
expires_atstring (date-time) or nulloptionalOptional RFC 3339 expiry, second precision, UTC; absent or an empty string (or null) means no expiry. A non-empty value not after the creation instant is refused (api-key-invalid).
Antworten
- 200
Issue a personal API key for the signed-in human.
Schema
IssuedAPIKeykey_idstringPflichtThe platform-minted key id (uppercase ULID).
pattern ^[0-9A-HJKMNP-TV-Z]{26}$
org_idstringPflichtpattern ^[a-z][a-z0-9._-]{0,63}$
namestringPflicht1 to 128 characters
principal_refstringPflichtpattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$
prefixstringPflichtThe display prefix (ccsio_ plus the first 8 entropy characters) — never the raw value, never a digest.
pattern ^ccsio_[A-Za-z0-9_-]{8}$
created_bystringPflichtpattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$
created_atstring (date-time)PflichtRFC 3339, second precision, UTC.
expires_atstring (date-time) or nullPflichtRFC 3339, second precision, UTC; null when the key has no expiry.
statestringPflichtA freshly issued key is always active.
Erlaubte Werte:
"active"revoked_atnull or nullPflichtA freshly issued key is never revoked; renders null.
rawstringPflichtThe raw key value, returned exactly once on successful issuance (service-account or personal): ccsio_ followed by 32 alphanumeric characters. Never returned by list, read or revoke operations, or included in errors or logs. Keys issued before this form (ccsio_ plus 43 base64url characters) remain valid credentials but are never minted again.
pattern ^ccsio_[A-Za-z0-9]{32}$
kindstringPflichtThe persisted credential type; existing service-account keys retain service_account.
Erlaubte Werte:
"personal""service_account"ownerobjectoptionaldisplay_namestringPflichtReadable owner name from the identity profile.
emailstringoptionalOwner email when known; presentation only, never an authorization identifier.
kindstringPflichtErlaubte Werte:
"human""service_account"
- 400
Client refusal unrelated to authentication, including malformed input, a denied or failed request.
- 401
The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:
Weiterlesen
Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled
- 403
The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.
Weiterlesen
Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)
- 404
The requested resource or path was not found.
- 405
The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.
- 500
Platform failure, rendered without internal cause details.
{
"key_id": "01K7YQ5E9N3Q7T1W4Y6A8C2D5G",
"kind": "personal",
"owner": {
"display_name": "Ana García",
"email": "[email protected]",
"kind": "human"
},
"org_id": "acme",
"name": "laptop",
"principal_ref": "user/onboard/01K7YN1B3C5D7F9H2K4M6P8R0T",
"prefix": "ccsio_ExampleK",
"created_by": "user/onboard/01K7YN1B3C5D7F9H2K4M6P8R0T",
"created_at": "2026-10-14T09:31:00Z",
"expires_at": null,
"state": "active",
"revoked_at": null,
"raw": "ccsio_ExampleKeyShownOnceAtCreation000"
}/identity/v1/self/api-keys/{id}Delete one of the signed-in human's revoked personal API keys
- Anmeldedaten
- Token einer angemeldeten Person (Console-Sitzung)
- Berechtigung
inference.read
Requires a verified human OIDC session, an active human identity and an active membership in the selected organization, exactly like revokePersonalKey; no inference.invoke or api-keys.manage permission is required.
Weiterlesen
Deletes only the caller's own personal key in that organization, and only once it is revoked: the key then disappears from every list and read (GET /identity/v1/self/api-keys and the organization's key list) and can never authenticate - it was revoked already. The record itself is kept, so audit references keep resolving: a security event's item label and actor.key_id still name the key. An ACTIVE key is refused 409 api-key-active (revoke it first); another owner's key, a service-account key, a foreign-organization key, an unknown id and an already deleted key are all 404 api-key-not-found. Sensitive: audited as api_key.deleted. No request body. Failures: 404 api-key-not-found; 409 api-key-active; 500 server faults.
curl -X DELETE "https://console.eu.ccsio.ai/identity/v1/self/api-keys/{id}" \
-H "Authorization: Bearer $CCSIO_ACCESS_TOKEN"Parameter
| Name | In | Beschreibung |
|---|---|---|
X-Request-IDoptional | header | string Optional request ULID. A valid ULID (upper or lowercase) is honored; when the header is absent or invalid, the runtime mints the id. The response X-Request-ID header carries the canonical uppercase form. |
X-Organization-Idoptional | header | string Selects one of the authenticated human's active organization memberships. The server resolves and verifies this selection into trusted context; request bodies cannot choose the owner or organization. WeiterlesenA platform operator (a human whose user holds the active platform role ccsio_admin) may also select ANY existing organization: where they hold no membership the context carries only the platform operator permission set and no role bindings. For every other human, naming an organization they hold no active membership in is refused with 403 organization-not-selectable. |
idPflicht | path | string The platform-minted API-key id (uppercase ULID). |
Antworten
- 204
The key is deleted. No body.
- 400
Client refusal unrelated to authentication, including malformed input, a denied or failed request.
- 401
The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:
Weiterlesen
Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled
- 403
The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.
Weiterlesen
Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)
- 404
The requested resource or path was not found.
- 405
The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.
- 409
The request conflicts with the current state of the resource or with an invariant it protects (a taken name, a role still in use, an organization that must not be deleted, an archived team, the last active root, a seat or service account limit).
- 500
Platform failure, rendered without internal cause details.
/identity/v1/self/api-keys/{id}/revokeRevoke one of the signed-in human's personal API keys
- Anmeldedaten
- Token einer angemeldeten Person (Console-Sitzung)
- Berechtigung
inference.read
Requires a verified human OIDC session, an active human identity and an active membership in the selected organization. Revokes only the caller's personal key in that organization; another owner's key, a service-account key or a foreign-organization key returns 404 api-key-not-found.
Weiterlesen
No inference.invoke or api-keys.manage permission is required. Revocation is terminal and idempotent: retry returns the stored revoked view. No request body; no raw key is returned. A deleted key is 404 api-key-not-found like an unknown one.
curl -X POST "https://console.eu.ccsio.ai/identity/v1/self/api-keys/{id}/revoke" \
-H "Authorization: Bearer $CCSIO_ACCESS_TOKEN"Parameter
| Name | In | Beschreibung |
|---|---|---|
X-Request-IDoptional | header | string Optional request ULID. A valid ULID (upper or lowercase) is honored; when the header is absent or invalid, the runtime mints the id. The response X-Request-ID header carries the canonical uppercase form. |
X-Organization-Idoptional | header | string Selects one of the authenticated human's active organization memberships. The server resolves and verifies this selection into trusted context; request bodies cannot choose the owner or organization. WeiterlesenA platform operator (a human whose user holds the active platform role ccsio_admin) may also select ANY existing organization: where they hold no membership the context carries only the platform operator permission set and no role bindings. For every other human, naming an organization they hold no active membership in is refused with 403 organization-not-selectable. |
idPflicht | path | string The platform-minted API-key id (uppercase ULID). |
Antworten
- 200
Revoke one of the signed-in human's personal API keys.
Schema
APIKeykey_idstringPflichtThe platform-minted key id (uppercase ULID).
pattern ^[0-9A-HJKMNP-TV-Z]{26}$
org_idstringPflichtpattern ^[a-z][a-z0-9._-]{0,63}$
namestringPflicht1 to 128 characters
principal_refstringPflichtpattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$
prefixstringPflichtThe display prefix (ccsio_ plus the first 8 entropy characters) — never the raw value, never a digest.
pattern ^ccsio_[A-Za-z0-9_-]{8}$
created_bystringPflichtpattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$
created_atstring (date-time)PflichtRFC 3339, second precision, UTC.
expires_atstring (date-time) or nullPflichtRFC 3339, second precision, UTC; null when the key has no expiry.
statestringPflichtThe key state; revoked is terminal.
Erlaubte Werte:
"active""revoked"revoked_atstring (date-time) or nullPflichtRFC 3339, second precision, UTC; null while active.
kindstringPflichtThe persisted credential type; existing service-account keys retain service_account.
Erlaubte Werte:
"personal""service_account"ownerobjectoptionaldisplay_namestringPflichtReadable owner name from the identity profile.
emailstringoptionalOwner email when known; presentation only, never an authorization identifier.
kindstringPflichtErlaubte Werte:
"human""service_account"
- 400
Client refusal unrelated to authentication, including malformed input, a denied or failed request.
- 401
The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:
Weiterlesen
Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled
- 403
The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.
Weiterlesen
Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)
- 404
The requested resource or path was not found.
- 405
The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.
- 500
Platform failure, rendered without internal cause details.
Erzeugt aus den Plattformverträgen beim Commit 5f833620.