api-keys

Issue a programmatic API key for the org (owner/admin; returns the secret ONCE)

Issues an API key scoped to this org, bound to either all projects or an explicit project-id allow-list, acting as role and optionally narrowed by limits (read-only: no changes; no-sql: no raw SQL; no-destructive: no deletes, revokes, hand-overs, payments, or destructive SQL). The secret (whc_key_…) is returned ONCE in the response and cannot be retrieved again — store it securely. Present it later as Authorization: Bearer <key> or X-API-Key: <key> to call the customer + engine-proxy surface.

post/v1/orgs/{org_id}/api-keys

Request

  • Base URL: https://api.wavehouse.cloud
  • URL: https://api.wavehouse.cloud/v1/orgs/{org_id}/api-keys
  • Auth: one of:
    • API key in cookie whc_session
    • HTTP bearer

Path parameters

org_idstring required

Headers

Idempotency-Keystring

A unique value you choose per logical request (a random UUID). A retry with the same key and the same request within 24 hours returns the first response, marked Idempotency-Replayed: true, instead of acting twice. The same key with a different request is refused with 422; one sent while the first is still running gets 409.

Request body

all_projectsboolean

grant the key access to EVERY project in the org; else set project_ids

limitsstring[]

narrow the key below its role: read-only (no changes), no-sql (no raw SQL), no-destructive (no deletes, revokes, hand-overs, payments, or destructive SQL)

namestring required

human-readable key name

project_idsstring[]

the project id(s) this key may touch; required unless all_projects=true

role'admin' | 'member'

org role the key acts as (default admin). member = read-only data surface; admin = full data surface + project mutations. owner is never issuable to a key.

Response

Created

all_projectsboolean required

true = the key may touch every project in the org

created_atstring date-time required
created_bystring required

user id that created the key

idstring required
key_prefixstring required

the key's first 14 characters (whc_key_ + 6), to tell keys apart

last4string required

the key's last four characters

last_used_atstring date-time

absent until first authenticated use; updated at most once a minute

limitsstring[] required

what the key may not do even where its role could; empty = only its role applies

namestring required
project_idsstring[] required

the project id(s) the key may touch (empty when all_projects)

rolestring required

org role the key acts as (admin | member)

secretstring required

the API key — shown ONCE; store it now, it cannot be retrieved again

Changes

No recorded changes to this operation across all 1 revision of this API.