Synq Docs
Management APIAPI keys

Make an API key

`sk_live_…` in production, `sk_test_…` elsewhere, in this response only. Its permissions are at most the caller's own in the org. Needs `org.apiKeys.edit`. Recorded as `api_key.created`.

POST/v1/orgs/{org}/api-keys

sk_live_… in production, sk_test_… elsewhere, in this response only. Its permissions are at most the caller's own in the org. Needs org.apiKeys.edit. Recorded as api_key.created.

Authorization

bearer
AuthorizationBearer <token>

An org API key (sk_live_…, sk_test_…), or an access token from the Synq issuer (the synq brand, on the accounts host) for this API.

In: header

Path Parameters

org*string

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/problem+json

application/problem+json

application/problem+json

application/problem+json

application/problem+json

curl -X POST "https://example.com/v1/orgs/string/api-keys" \  -H "Content-Type: application/json" \  -d '{    "name": "string",    "permissions": [      "org.read"    ]  }'
{  "id": "string",  "name": "string",  "prefix": "string",  "permissions": [    "string"  ],  "ip_allowlist": [    "string"  ],  "expires_at": "2019-08-24T14:15:22Z",  "revoked_at": "2019-08-24T14:15:22Z",  "last_used_at": "2019-08-24T14:15:22Z",  "created_by": "string",  "created_at": "2019-08-24T14:15:22Z",  "key": "string"}

A user's API keys GET

The keys they made for the brand's APIs (AERO-1693), oldest first, revoked and expired ones too; never a key itself. Needs `org.users.view`.

Delete an API DELETE

From then on, a request for it fails with `invalid_target`; tokens already issued for it live out their few minutes. Needs `org.apis.edit`. Recorded as `api.deleted`.