Personal API keys

Las descripciones de las operaciones y los campos son las del contrato, en inglés.

GET/identity/v1/self/api-keys

List the signed-in human's personal API keys

Credencial: El token de una persona con sesión iniciada (consola)
Permiso: inference.read

Requires a verified human OIDC session, an active human identity and an active membership in the organization selected by trusted context. Returns only this caller's personal keys in that organization, ordered by key ID, without raw values or digests. Does not require inference.invoke or api-keys.manage, so a member who lost creation permission can still inspect their keys. API keys and bootstrap credentials are refused. A deleted key is not listed.

curl

curl "https://console.latam.ccsio.ai/identity/v1/self/api-keys" \
  -H "Authorization: Bearer $CCSIO_ACCESS_TOKEN"

Parámetros

Nombre	En	Descripción
`X-Request-ID` opcional	header	string Optional request ULID. A valid ULID (upper or lowercase) is honored; when the header is absent or invalid, the runtime mints the id. The response X-Request-ID header carries the canonical uppercase form.
`X-Organization-Id` opcional	header	string Selects one of the authenticated human's active organization memberships. The server resolves and verifies this selection into trusted context; request bodies cannot choose the owner or organization. Leer más A platform operator (a human whose user holds the active platform role ccsio_admin) may also select ANY existing organization: where they hold no membership the context carries only the platform operator permission set and no role bindings. For every other human, naming an organization they hold no active membership in is refused with 403 organization-not-selectable.

Respuestas

200
List the signed-in human's personal API keys.
Esquema
ListAPIKeysResponse
api_keysarray of APIKeyobligatorio
key_idstringobligatorio
The platform-minted key id (uppercase ULID).
pattern ^[0-9A-HJKMNP-TV-Z]{26}$
org_idstringobligatorio
pattern ^[a-z][a-z0-9._-]{0,63}$
namestringobligatorio
1 to 128 characters
principal_refstringobligatorio
pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$
prefixstringobligatorio
The display prefix (ccsio_ plus the first 8 entropy characters) — never the raw value, never a digest.
pattern ^ccsio_[A-Za-z0-9_-]{8}$
created_bystringobligatorio
pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$
created_atstring (date-time)obligatorio
RFC 3339, second precision, UTC.
expires_atstring (date-time) or nullobligatorio
RFC 3339, second precision, UTC; null when the key has no expiry.
statestringobligatorio
The key state; revoked is terminal.
Valores permitidos: "active""revoked"
revoked_atstring (date-time) or nullobligatorio
RFC 3339, second precision, UTC; null while active.
kindstringobligatorio
The persisted credential type; existing service-account keys retain service_account.
Valores permitidos: "personal""service_account"
ownerobjectopcional
display_namestringobligatorio
Readable owner name from the identity profile.
emailstringopcional
Owner email when known; presentation only, never an authorization identifier.
kindstringobligatorio
Valores permitidos: "human""service_account"
400
Client refusal unrelated to authentication, including malformed input, a denied or failed request.
401
The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:
Leer más
Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled
403
The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.
Leer más
Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)
404
The requested resource or path was not found.
405
The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.
500
Platform failure, rendered without internal cause details.

POST/identity/v1/self/api-keys

Issue a personal API key for the signed-in human

Credencial: El token de una persona con sesión iniciada (consola)
Permiso: inference.invoke
Cuerpo de la solicitud: Cuerpo de hasta 1 MiB

Requires a verified human OIDC session, an active human identity, an active organization membership and current inference.invoke permission in the selected organization.

The server derives owner, creator and fixed organization from trusted context; principal_ref, created_by and org_id are not accepted. The personal key authorizes inference (the /v1/* surface) and the aggregated MCP endpoint (POST /mcp/) and never administrative control-plane operations; its use of the MCP endpoint additionally requires its owner to hold mcp.invoke in the organization. Every use rechecks the owner's active identity and membership; platform authority is never inherited. name is required (1–128 UTF-8 bytes). expires_at is optional RFC 3339; absent, null or an empty string means no expiry, and a value not after creation is refused with 400 api-key-invalid. The raw value is returned once at creation. Issuance is not idempotent; a repeated successful request creates another key.

curl

curl -X POST "https://console.latam.ccsio.ai/identity/v1/self/api-keys" \
  -H "Authorization: Bearer $CCSIO_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
  "name": "laptop"
}'

Parámetros

Nombre	En	Descripción
`X-Request-ID` opcional	header	string Optional request ULID. A valid ULID (upper or lowercase) is honored; when the header is absent or invalid, the runtime mints the id. The response X-Request-ID header carries the canonical uppercase form.
`X-Organization-Id` opcional	header	string Selects one of the authenticated human's active organization memberships. The server resolves and verifies this selection into trusted context; request bodies cannot choose the owner or organization. Leer más A platform operator (a human whose user holds the active platform role ccsio_admin) may also select ANY existing organization: where they hold no membership the context carries only the platform operator permission set and no role bindings. For every other human, naming an organization they hold no active membership in is refused with 403 organization-not-selectable.

Cuerpo de la solicitud application/json

IssuePersonalKeyRequest

namestringobligatorio
Readable key name, 1–128 UTF-8 bytes.
1 to 128 characters
expires_atstring (date-time) or nullopcional
Optional RFC 3339 expiry, second precision, UTC; absent or an empty string (or null) means no expiry. A non-empty value not after the creation instant is refused (api-key-invalid).

Respuestas

200
Issue a personal API key for the signed-in human.
Esquema
IssuedAPIKey
key_idstringobligatorio
The platform-minted key id (uppercase ULID).
pattern ^[0-9A-HJKMNP-TV-Z]{26}$
org_idstringobligatorio
pattern ^[a-z][a-z0-9._-]{0,63}$
namestringobligatorio
1 to 128 characters
principal_refstringobligatorio
pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$
prefixstringobligatorio
The display prefix (ccsio_ plus the first 8 entropy characters) — never the raw value, never a digest.
pattern ^ccsio_[A-Za-z0-9_-]{8}$
created_bystringobligatorio
pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$
created_atstring (date-time)obligatorio
RFC 3339, second precision, UTC.
expires_atstring (date-time) or nullobligatorio
RFC 3339, second precision, UTC; null when the key has no expiry.
statestringobligatorio
A freshly issued key is always active.
Valores permitidos: "active"
revoked_atnull or nullobligatorio
A freshly issued key is never revoked; renders null.
rawstringobligatorio
The raw key value, returned exactly once on successful issuance (service-account or personal): ccsio_ followed by 32 alphanumeric characters. Never returned by list, read or revoke operations, or included in errors or logs. Keys issued before this form (ccsio_ plus 43 base64url characters) remain valid credentials but are never minted again.
pattern ^ccsio_[A-Za-z0-9]{32}$
kindstringobligatorio
The persisted credential type; existing service-account keys retain service_account.
Valores permitidos: "personal""service_account"
ownerobjectopcional
display_namestringobligatorio
Readable owner name from the identity profile.
emailstringopcional
Owner email when known; presentation only, never an authorization identifier.
kindstringobligatorio
Valores permitidos: "human""service_account"
400
Client refusal unrelated to authentication, including malformed input, a denied or failed request.
401
The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:
Leer más
Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled
403
The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.
Leer más
Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)
404
The requested resource or path was not found.
405
The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.
500
Platform failure, rendered without internal cause details.

Respuesta de ejemplo

{
  "key_id": "01K7YQ5E9N3Q7T1W4Y6A8C2D5G",
  "kind": "personal",
  "owner": {
    "display_name": "Ana García",
    "email": "[email protected]",
    "kind": "human"
  },
  "org_id": "acme",
  "name": "laptop",
  "principal_ref": "user/onboard/01K7YN1B3C5D7F9H2K4M6P8R0T",
  "prefix": "ccsio_ExampleK",
  "created_by": "user/onboard/01K7YN1B3C5D7F9H2K4M6P8R0T",
  "created_at": "2026-10-14T09:31:00Z",
  "expires_at": null,
  "state": "active",
  "revoked_at": null,
  "raw": "ccsio_ExampleKeyShownOnceAtCreation000"
}

DELETE/identity/v1/self/api-keys/{id}

Delete one of the signed-in human's revoked personal API keys

Credencial: El token de una persona con sesión iniciada (consola)
Permiso: inference.read

Requires a verified human OIDC session, an active human identity and an active membership in the selected organization, exactly like revokePersonalKey; no inference.invoke or api-keys.manage permission is required.

Deletes only the caller's own personal key in that organization, and only once it is revoked: the key then disappears from every list and read (GET /identity/v1/self/api-keys and the organization's key list) and can never authenticate - it was revoked already. The record itself is kept, so audit references keep resolving: a security event's item label and actor.key_id still name the key. An ACTIVE key is refused 409 api-key-active (revoke it first); another owner's key, a service-account key, a foreign-organization key, an unknown id and an already deleted key are all 404 api-key-not-found. Sensitive: audited as api_key.deleted. No request body. Failures: 404 api-key-not-found; 409 api-key-active; 500 server faults.

curl

curl -X DELETE "https://console.latam.ccsio.ai/identity/v1/self/api-keys/{id}" \
  -H "Authorization: Bearer $CCSIO_ACCESS_TOKEN"

Parámetros

Nombre	En	Descripción
`X-Request-ID` opcional	header	string Optional request ULID. A valid ULID (upper or lowercase) is honored; when the header is absent or invalid, the runtime mints the id. The response X-Request-ID header carries the canonical uppercase form.
`X-Organization-Id` opcional	header	string Selects one of the authenticated human's active organization memberships. The server resolves and verifies this selection into trusted context; request bodies cannot choose the owner or organization. Leer más A platform operator (a human whose user holds the active platform role ccsio_admin) may also select ANY existing organization: where they hold no membership the context carries only the platform operator permission set and no role bindings. For every other human, naming an organization they hold no active membership in is refused with 403 organization-not-selectable.
`id` obligatorio	path	string The platform-minted API-key id (uppercase ULID).

Respuestas

204
The key is deleted. No body.
400
Client refusal unrelated to authentication, including malformed input, a denied or failed request.
401
The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:
Leer más
Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled
403
The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.
Leer más
Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)
404
The requested resource or path was not found.
405
The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.
409
The request conflicts with the current state of the resource or with an invariant it protects (a taken name, a role still in use, an organization that must not be deleted, an archived team, the last active root, a seat or service account limit).
500
Platform failure, rendered without internal cause details.

POST/identity/v1/self/api-keys/{id}/revoke

Revoke one of the signed-in human's personal API keys

Credencial: El token de una persona con sesión iniciada (consola)
Permiso: inference.read

Requires a verified human OIDC session, an active human identity and an active membership in the selected organization. Revokes only the caller's personal key in that organization; another owner's key, a service-account key or a foreign-organization key returns 404 api-key-not-found.

No inference.invoke or api-keys.manage permission is required. Revocation is terminal and idempotent: retry returns the stored revoked view. No request body; no raw key is returned. A deleted key is 404 api-key-not-found like an unknown one.

curl

curl -X POST "https://console.latam.ccsio.ai/identity/v1/self/api-keys/{id}/revoke" \
  -H "Authorization: Bearer $CCSIO_ACCESS_TOKEN"

Parámetros

Nombre	En	Descripción
`X-Request-ID` opcional	header	string Optional request ULID. A valid ULID (upper or lowercase) is honored; when the header is absent or invalid, the runtime mints the id. The response X-Request-ID header carries the canonical uppercase form.
`X-Organization-Id` opcional	header	string Selects one of the authenticated human's active organization memberships. The server resolves and verifies this selection into trusted context; request bodies cannot choose the owner or organization. Leer más A platform operator (a human whose user holds the active platform role ccsio_admin) may also select ANY existing organization: where they hold no membership the context carries only the platform operator permission set and no role bindings. For every other human, naming an organization they hold no active membership in is refused with 403 organization-not-selectable.
`id` obligatorio	path	string The platform-minted API-key id (uppercase ULID).

Respuestas

200
Revoke one of the signed-in human's personal API keys.
Esquema
APIKey
key_idstringobligatorio
The platform-minted key id (uppercase ULID).
pattern ^[0-9A-HJKMNP-TV-Z]{26}$
org_idstringobligatorio
pattern ^[a-z][a-z0-9._-]{0,63}$
namestringobligatorio
1 to 128 characters
principal_refstringobligatorio
pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$
prefixstringobligatorio
The display prefix (ccsio_ plus the first 8 entropy characters) — never the raw value, never a digest.
pattern ^ccsio_[A-Za-z0-9_-]{8}$
created_bystringobligatorio
pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$
created_atstring (date-time)obligatorio
RFC 3339, second precision, UTC.
expires_atstring (date-time) or nullobligatorio
RFC 3339, second precision, UTC; null when the key has no expiry.
statestringobligatorio
The key state; revoked is terminal.
Valores permitidos: "active""revoked"
revoked_atstring (date-time) or nullobligatorio
RFC 3339, second precision, UTC; null while active.
kindstringobligatorio
The persisted credential type; existing service-account keys retain service_account.
Valores permitidos: "personal""service_account"
ownerobjectopcional
display_namestringobligatorio
Readable owner name from the identity profile.
emailstringopcional
Owner email when known; presentation only, never an authorization identifier.
kindstringobligatorio
Valores permitidos: "human""service_account"
400
Client refusal unrelated to authentication, including malformed input, a denied or failed request.
401
The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:
Leer más
Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled
403
The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.
Leer más
Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)
404
The requested resource or path was not found.
405
The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.
500
Platform failure, rendered without internal cause details.

Generado a partir de los contratos de la plataforma en el commit 5f833620.

List the signed-in human's personal API keys

Parámetros

Respuestas

Issue a personal API key for the signed-in human

Parámetros

Cuerpo de la solicitud application/json

Respuestas

Delete one of the signed-in human's revoked personal API keys

Parámetros

Respuestas

Revoke one of the signed-in human's personal API keys

Parámetros

Respuestas

Obtén tu primera key API