keys

Make a key with this key, with no browser: a key per worker in an agent swarm.

Needs a full-access key made by an owner or admin (a wallet account's key is one). A read-only key, a developer's or one in a compartment cannot. The new key never has more than this one: account-wide only from an account-wide key, this key's expiry and per-request cap, and when this key has a daily limit, the daily limits of the keys it made add up to at most its own. Each key gets its own agent, so its sandboxes, spend and audit rows are its own. At most 100 live keys made this way in an account, and 1,000 made in any 24 hours; revoke a worker's key when it is done. Every key made is in the audit log as key.created, naming the key that made it.

post/v1/keys

Request

  • Base URL: https://api.withruntime.com
  • URL: https://api.withruntime.com/v1/keys
  • Auth: HTTP bearer

Headers

Idempotency-Keystring

Replaying the same key with the same request within 24 hours returns the first result and never repeats the effect. A refusal is not kept: a request refused before it ran (no_capacity, busy, a limit) runs afresh when sent again with its key. The SDKs send one automatically; the server makes one when absent and returns it in the idempotency-key response header.

Request body

namestring required

The key's name, and its agent's.

access'full' | 'read'

full: every action in every product (the default). read: every read and nothing else.

reach'agent' | 'account'

agent (the default): the key sees and acts on only what its own agent makes, so a worker sees only its own sandboxes. account: everything in the account; only an account-wide key can make one.

dailyLimitMicrosinteger nullable

The most the key's agent may commit in any 24 hours, in integer microdollars (5000000 = $5), or null for none. Required when the making key has a limit; the limits of the keys a key made add up to at most its own. A read-only key takes none.

sandboxesstring[]

Limit the key to these sandboxes, by id: it is served only their own routes (get, metrics, stop, pause, wake, restart, exec, processes, files, interpreter) and only the actions given, and calls them by id. Not with access or reach. Only sandboxes this key acts on, outside every compartment.

actionsstring[]

With sandboxes: what the key may do to them. get reads them; create starts, wakes and restarts them (never makes a sandbox), and is the one that spends; stop stops and pauses them; exec runs commands and processes; read_file and write_file reach their files.

Response

Success

keystring

The new key. Shown once: Runtime keeps only its hash. A retry with the same Idempotency-Key answers without it.

keyIdstring required

The key's id.

agentIdstring required

The new key's own agent: what it makes is that agent's.

orgIdstring required
namestring required
access'full' | 'read' | 'selected' required
reach'agent' | 'account' | 'sandboxes' required

agent: what its own agent makes. account: everything in the account. sandboxes: only the sandboxes it is limited to.

dailyLimitMicrosinteger nullable required

The most the key's agent may commit in any 24 hours, in integer microdollars (5000000 = $5), or null for none. Required when the making key has a limit; the limits of the keys a key made add up to at most its own. A read-only key takes none.

sandboxesstring[] nullable

The sandboxes it is limited to, by id, or null for a key that is not limited.

actionsstring[] nullable

What it may do, for a key of named actions, or null for full and read.

expiresstring date-time nullable required

When it stops working: the making key's expiry, or null for until revoked.

madeBystring required

The id of the key that made it.

Changes

No recorded changes to this operation across all 1 revision of this API.