Personal API keys

The descriptions of the operations and fields are the contract’s own, in English.

GET/identity/v1/self/api-keys

List the signed-in human's personal API keys

Credential: A signed-in person’s token (Console session)
Permission: inference.read

Requires a verified human OIDC session, an active human identity and an active membership in the organization selected by trusted context. Returns only this caller's personal keys in that organization, ordered by key ID, without raw values or digests. Does not require inference.invoke or api-keys.manage, so a member who lost creation permission can still inspect their keys. API keys and bootstrap credentials are refused. A deleted key is not listed.

curl

curl "https://console.us.ccsio.ai/identity/v1/self/api-keys" \
  -H "Authorization: Bearer $CCSIO_ACCESS_TOKEN"

Parameters

Name	In	Description
`X-Request-ID` optional	header	string Optional request ULID. A valid ULID (upper or lowercase) is honored; when the header is absent or invalid, the runtime mints the id. The response X-Request-ID header carries the canonical uppercase form.
`X-Organization-Id` optional	header	string Selects one of the authenticated human's active organization memberships. The server resolves and verifies this selection into trusted context; request bodies cannot choose the owner or organization. Read more A platform operator (a human whose user holds the active platform role ccsio_admin) may also select ANY existing organization: where they hold no membership the context carries only the platform operator permission set and no role bindings. For every other human, naming an organization they hold no active membership in is refused with 403 organization-not-selectable.

Responses

200
List the signed-in human's personal API keys.
Schema
ListAPIKeysResponse
api_keysarray of APIKeyrequired
key_idstringrequired
The platform-minted key id (uppercase ULID).
pattern ^[0-9A-HJKMNP-TV-Z]{26}$
org_idstringrequired
pattern ^[a-z][a-z0-9._-]{0,63}$
namestringrequired
1 to 128 characters
principal_refstringrequired
pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$
prefixstringrequired
The display prefix (ccsio_ plus the first 8 entropy characters) — never the raw value, never a digest.
pattern ^ccsio_[A-Za-z0-9_-]{8}$
created_bystringrequired
pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$
created_atstring (date-time)required
RFC 3339, second precision, UTC.
expires_atstring (date-time) or nullrequired
RFC 3339, second precision, UTC; null when the key has no expiry.
statestringrequired
The key state; revoked is terminal.
Allowed values: "active""revoked"
revoked_atstring (date-time) or nullrequired
RFC 3339, second precision, UTC; null while active.
kindstringrequired
The persisted credential type; existing service-account keys retain service_account.
Allowed values: "personal""service_account"
ownerobjectoptional
display_namestringrequired
Readable owner name from the identity profile.
emailstringoptional
Owner email when known; presentation only, never an authorization identifier.
kindstringrequired
Allowed values: "human""service_account"
400
Client refusal unrelated to authentication, including malformed input, a denied or failed request.
401
The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:
Read more
Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled
403
The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.
Read more
Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)
404
The requested resource or path was not found.
405
The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.
500
Platform failure, rendered without internal cause details.

POST/identity/v1/self/api-keys

Issue a personal API key for the signed-in human

Credential: A signed-in person’s token (Console session)
Permission: inference.invoke
Request body: Body up to 1 MiB

Requires a verified human OIDC session, an active human identity, an active organization membership and current inference.invoke permission in the selected organization.

The server derives owner, creator and fixed organization from trusted context; principal_ref, created_by and org_id are not accepted. The personal key authorizes inference (the /v1/* surface) and the aggregated MCP endpoint (POST /mcp/) and never administrative control-plane operations; its use of the MCP endpoint additionally requires its owner to hold mcp.invoke in the organization. Every use rechecks the owner's active identity and membership; platform authority is never inherited. name is required (1–128 UTF-8 bytes). expires_at is optional RFC 3339; absent, null or an empty string means no expiry, and a value not after creation is refused with 400 api-key-invalid. The raw value is returned once at creation. Issuance is not idempotent; a repeated successful request creates another key.

curl

curl -X POST "https://console.us.ccsio.ai/identity/v1/self/api-keys" \
  -H "Authorization: Bearer $CCSIO_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
  "name": "laptop"
}'

Parameters

Name	In	Description
`X-Request-ID` optional	header	string Optional request ULID. A valid ULID (upper or lowercase) is honored; when the header is absent or invalid, the runtime mints the id. The response X-Request-ID header carries the canonical uppercase form.
`X-Organization-Id` optional	header	string Selects one of the authenticated human's active organization memberships. The server resolves and verifies this selection into trusted context; request bodies cannot choose the owner or organization. Read more A platform operator (a human whose user holds the active platform role ccsio_admin) may also select ANY existing organization: where they hold no membership the context carries only the platform operator permission set and no role bindings. For every other human, naming an organization they hold no active membership in is refused with 403 organization-not-selectable.

Request body application/json

IssuePersonalKeyRequest

namestringrequired
Readable key name, 1–128 UTF-8 bytes.
1 to 128 characters
expires_atstring (date-time) or nulloptional
Optional RFC 3339 expiry, second precision, UTC; absent or an empty string (or null) means no expiry. A non-empty value not after the creation instant is refused (api-key-invalid).

Responses

200
Issue a personal API key for the signed-in human.
Schema
IssuedAPIKey
key_idstringrequired
The platform-minted key id (uppercase ULID).
pattern ^[0-9A-HJKMNP-TV-Z]{26}$
org_idstringrequired
pattern ^[a-z][a-z0-9._-]{0,63}$
namestringrequired
1 to 128 characters
principal_refstringrequired
pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$
prefixstringrequired
The display prefix (ccsio_ plus the first 8 entropy characters) — never the raw value, never a digest.
pattern ^ccsio_[A-Za-z0-9_-]{8}$
created_bystringrequired
pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$
created_atstring (date-time)required
RFC 3339, second precision, UTC.
expires_atstring (date-time) or nullrequired
RFC 3339, second precision, UTC; null when the key has no expiry.
statestringrequired
A freshly issued key is always active.
Allowed values: "active"
revoked_atnull or nullrequired
A freshly issued key is never revoked; renders null.
rawstringrequired
The raw key value, returned exactly once on successful issuance (service-account or personal): ccsio_ followed by 32 alphanumeric characters. Never returned by list, read or revoke operations, or included in errors or logs. Keys issued before this form (ccsio_ plus 43 base64url characters) remain valid credentials but are never minted again.
pattern ^ccsio_[A-Za-z0-9]{32}$
kindstringrequired
The persisted credential type; existing service-account keys retain service_account.
Allowed values: "personal""service_account"
ownerobjectoptional
display_namestringrequired
Readable owner name from the identity profile.
emailstringoptional
Owner email when known; presentation only, never an authorization identifier.
kindstringrequired
Allowed values: "human""service_account"
400
Client refusal unrelated to authentication, including malformed input, a denied or failed request.
401
The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:
Read more
Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled
403
The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.
Read more
Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)
404
The requested resource or path was not found.
405
The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.
500
Platform failure, rendered without internal cause details.

Example response

{
  "key_id": "01K7YQ5E9N3Q7T1W4Y6A8C2D5G",
  "kind": "personal",
  "owner": {
    "display_name": "Ana García",
    "email": "[email protected]",
    "kind": "human"
  },
  "org_id": "acme",
  "name": "laptop",
  "principal_ref": "user/onboard/01K7YN1B3C5D7F9H2K4M6P8R0T",
  "prefix": "ccsio_ExampleK",
  "created_by": "user/onboard/01K7YN1B3C5D7F9H2K4M6P8R0T",
  "created_at": "2026-10-14T09:31:00Z",
  "expires_at": null,
  "state": "active",
  "revoked_at": null,
  "raw": "ccsio_ExampleKeyShownOnceAtCreation000"
}

DELETE/identity/v1/self/api-keys/{id}

Delete one of the signed-in human's revoked personal API keys

Credential: A signed-in person’s token (Console session)
Permission: inference.read

Requires a verified human OIDC session, an active human identity and an active membership in the selected organization, exactly like revokePersonalKey; no inference.invoke or api-keys.manage permission is required.

Deletes only the caller's own personal key in that organization, and only once it is revoked: the key then disappears from every list and read (GET /identity/v1/self/api-keys and the organization's key list) and can never authenticate - it was revoked already. The record itself is kept, so audit references keep resolving: a security event's item label and actor.key_id still name the key. An ACTIVE key is refused 409 api-key-active (revoke it first); another owner's key, a service-account key, a foreign-organization key, an unknown id and an already deleted key are all 404 api-key-not-found. Sensitive: audited as api_key.deleted. No request body. Failures: 404 api-key-not-found; 409 api-key-active; 500 server faults.

curl

curl -X DELETE "https://console.us.ccsio.ai/identity/v1/self/api-keys/{id}" \
  -H "Authorization: Bearer $CCSIO_ACCESS_TOKEN"

Parameters

Name	In	Description
`X-Request-ID` optional	header	string Optional request ULID. A valid ULID (upper or lowercase) is honored; when the header is absent or invalid, the runtime mints the id. The response X-Request-ID header carries the canonical uppercase form.
`X-Organization-Id` optional	header	string Selects one of the authenticated human's active organization memberships. The server resolves and verifies this selection into trusted context; request bodies cannot choose the owner or organization. Read more A platform operator (a human whose user holds the active platform role ccsio_admin) may also select ANY existing organization: where they hold no membership the context carries only the platform operator permission set and no role bindings. For every other human, naming an organization they hold no active membership in is refused with 403 organization-not-selectable.
`id` required	path	string The platform-minted API-key id (uppercase ULID).

Responses

204
The key is deleted. No body.
400
Client refusal unrelated to authentication, including malformed input, a denied or failed request.
401
The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:
Read more
Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled
403
The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.
Read more
Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)
404
The requested resource or path was not found.
405
The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.
409
The request conflicts with the current state of the resource or with an invariant it protects (a taken name, a role still in use, an organization that must not be deleted, an archived team, the last active root, a seat or service account limit).
500
Platform failure, rendered without internal cause details.

POST/identity/v1/self/api-keys/{id}/revoke

Revoke one of the signed-in human's personal API keys

Credential: A signed-in person’s token (Console session)
Permission: inference.read

Requires a verified human OIDC session, an active human identity and an active membership in the selected organization. Revokes only the caller's personal key in that organization; another owner's key, a service-account key or a foreign-organization key returns 404 api-key-not-found.

No inference.invoke or api-keys.manage permission is required. Revocation is terminal and idempotent: retry returns the stored revoked view. No request body; no raw key is returned. A deleted key is 404 api-key-not-found like an unknown one.

curl

curl -X POST "https://console.us.ccsio.ai/identity/v1/self/api-keys/{id}/revoke" \
  -H "Authorization: Bearer $CCSIO_ACCESS_TOKEN"

Parameters

Name	In	Description
`X-Request-ID` optional	header	string Optional request ULID. A valid ULID (upper or lowercase) is honored; when the header is absent or invalid, the runtime mints the id. The response X-Request-ID header carries the canonical uppercase form.
`X-Organization-Id` optional	header	string Selects one of the authenticated human's active organization memberships. The server resolves and verifies this selection into trusted context; request bodies cannot choose the owner or organization. Read more A platform operator (a human whose user holds the active platform role ccsio_admin) may also select ANY existing organization: where they hold no membership the context carries only the platform operator permission set and no role bindings. For every other human, naming an organization they hold no active membership in is refused with 403 organization-not-selectable.
`id` required	path	string The platform-minted API-key id (uppercase ULID).

Responses

200
Revoke one of the signed-in human's personal API keys.
Schema
APIKey
key_idstringrequired
The platform-minted key id (uppercase ULID).
pattern ^[0-9A-HJKMNP-TV-Z]{26}$
org_idstringrequired
pattern ^[a-z][a-z0-9._-]{0,63}$
namestringrequired
1 to 128 characters
principal_refstringrequired
pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$
prefixstringrequired
The display prefix (ccsio_ plus the first 8 entropy characters) — never the raw value, never a digest.
pattern ^ccsio_[A-Za-z0-9_-]{8}$
created_bystringrequired
pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$
created_atstring (date-time)required
RFC 3339, second precision, UTC.
expires_atstring (date-time) or nullrequired
RFC 3339, second precision, UTC; null when the key has no expiry.
statestringrequired
The key state; revoked is terminal.
Allowed values: "active""revoked"
revoked_atstring (date-time) or nullrequired
RFC 3339, second precision, UTC; null while active.
kindstringrequired
The persisted credential type; existing service-account keys retain service_account.
Allowed values: "personal""service_account"
ownerobjectoptional
display_namestringrequired
Readable owner name from the identity profile.
emailstringoptional
Owner email when known; presentation only, never an authorization identifier.
kindstringrequired
Allowed values: "human""service_account"
400
Client refusal unrelated to authentication, including malformed input, a denied or failed request.
401
The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:
Read more
Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled
403
The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.
Read more
Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)
404
The requested resource or path was not found.
405
The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.
500
Platform failure, rendered without internal cause details.

Generated from the platform contracts at commit 5f833620.

List the signed-in human's personal API keys

Parameters

Responses

Issue a personal API key for the signed-in human

Parameters

Request body application/json

Responses

Delete one of the signed-in human's revoked personal API keys

Parameters

Responses

Revoke one of the signed-in human's personal API keys

Parameters

Responses

Get your first API key