ApiKeys
3 operations. {prefix} is the route prefix passed to
MapAgentPrism; the template uses /agentprism.
GET {prefix}/api/api-keys
Section titled “GET {prefix}/api/api-keys”Operation ID: AgentPrismListApiKeys
Lists a tenant’s API keys.
The response carries neither the raw value nor a hash.
Authorization: bearer authentication; Admin role policy when that policy is registered; SecurityAdmin API-key scope.
| Response | Body | Headers |
|---|---|---|
| 200 OK | application/json → array of ApiKeyRecord |
— |
POST {prefix}/api/api-keys
Section titled “POST {prefix}/api/api-keys”Operation ID: AgentPrismCreateApiKey
Generates a new API key.
The raw value is returned in the response ONLY ON THIS CALL and cannot be produced again. The scope list is closed; an unknown scope is rejected. If the request was authenticated with an API key, a scope that key does NOT ITSELF CARRY cannot be requested (privilege extension/attenuation).
Authorization: bearer authentication; Admin role policy when that policy is registered; SecurityAdmin API-key scope.
Request body (required):
application/json→ApiKeyCreateRequest
| Response | Body | Headers |
|---|---|---|
| 200 OK | application/json → ApiKeyCreationResult |
— |
DELETE {prefix}/api/api-keys/{id}
Section titled “DELETE {prefix}/api/api-keys/{id}”Operation ID: AgentPrismRevokeApiKey
Revokes a key.
The row is NOT deleted; a revocation timestamp is written and stays in the audit trail.
Authorization: bearer authentication; Admin role policy when that policy is registered; SecurityAdmin API-key scope.
| Parameter | In | Required | Type | Description and rules |
|---|---|---|---|---|
id |
path | yes | string (uuid) |
— |
| Response | Body | Headers |
|---|---|---|
| 204 No Content | — | — |