> For the complete documentation index, see [llms.txt](https://hub.equipme.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hub.equipme.io/development/api-reference-solvio-beta/api-key.md).
# API key
An **API key** lets a machine act without a user token. A key belongs to an actor: whatever it does, it does with that actor's permissions, and every request it makes is attributable.
The secret is shown **once**, in the answer to its creation, and is never retrievable afterwards — only its hash is stored. Keys expire; a key without an explicit lifetime lasts 90 days, and no key may be issued for longer than a year.
## List API keys
> Returns the tenant's API keys — their labels, actors and lifetimes, never their secrets.\
> \
> \*\*Filterable\*\* — \`id\`, \`label\`, \`ident\`, \`actorId\`, \`creatorId\`, \`expiresAt\`, \`revokedAt\`, \`usedAt\`,\
> \`createdAt\`.\
> \
> \*\*Sortable\*\* — \`id\`, \`label\`, \`ident\`, \`expiresAt\`, \`revokedAt\`, \`usedAt\`, \`createdAt\`.\
> \
> \*\*Searchable\*\* — \`ident\`, \`label\`.\
> \
> \`usedAt\` is when the key was last accepted and \`revokedAt\` when it was withdrawn — keys that are still\
> usable are \`{"field":"revokedAt","op":"isNull"}\`. \`revokedAt\` is set by \`DELETE /v1/keys/{keyId}\`.
```json
{"openapi":"3.1.0","info":{"title":"Solvio REST API","version":"1.0.0-beta"},"tags":[{"description":"An **API key** lets a machine act without a user token. A key belongs to an actor: whatever it does,\nit does with that actor's permissions, and every request it makes is attributable.\n\nThe secret is shown **once**, in the answer to its creation, and is never retrievable afterwards —\nonly its hash is stored. Keys expire; a key without an explicit lifetime lasts 90 days, and no key may\nbe issued for longer than a year.\n","name":"key"}],"servers":[{"description":"The host serving this document","url":"/api"}],"security":[{"BearerAuth":[]},{"ApiKeyAuth":[]}],"components":{"securitySchemes":{"BearerAuth":{"description":"Token issued by the central equipme authentication, sent as `Bearer `.","scheme":"bearer","type":"http"},"ApiKeyAuth":{"description":"Static key for machine-to-machine access. Alternative to BearerAuth.","in":"header","name":"X-API-Key","type":"apiKey"}},"schemas":{"v1.ListKeysResponse-domain_Key":{"properties":{"count":{"type":"integer"},"data":{"items":{"$ref":"#/components/schemas/domain.Key"},"type":"array","uniqueItems":false}},"type":"object"},"domain.Key":{"properties":{"actor":{"$ref":"#/components/schemas/domain.User"},"actorId":{"type":"integer"},"createdAt":{"type":"string"},"creator":{"$ref":"#/components/schemas/domain.User"},"creatorId":{"type":"integer"},"expiresAt":{"type":"string"},"id":{"type":"integer"},"ident":{"type":"string"},"label":{"type":"string"},"revokedAt":{"type":"string"},"scopes":{"items":{"$ref":"#/components/schemas/domain.KeyScope"},"type":"array","uniqueItems":false},"usedAt":{"type":"string"}},"type":"object"},"domain.User":{"properties":{"contacts":{"items":{"$ref":"#/components/schemas/domain.Contact"},"type":"array","uniqueItems":false},"id":{"description":"id is the only queryable field — User is an internal/identity entity with no\nuser-facing scoped list; its reads are by-id (Query) or bespoke (identity/contact).","type":"integer"},"realm":{"type":"string"},"sub":{"type":"string"},"tenant":{"$ref":"#/components/schemas/domain.Tenant"},"tenantId":{"type":"integer"},"tenantRole":{"$ref":"#/components/schemas/domain.TenantRole"},"username":{"type":"string"}},"type":"object"},"domain.Contact":{"properties":{"assignmentContext":{"type":"string"},"autoAssign":{"description":"AutoAssign / AssignmentContext drive automated ticket routing. Set today only on\nGROUP-kind contacts via the group endpoints; nil/empty on ordinary contacts.","type":"boolean"},"createdAt":{"format":"date-time","type":"string"},"description":{"type":"string"},"email":{"type":"string"},"firstName":{"type":"string"},"id":{"type":"integer"},"kind":{"$ref":"#/components/schemas/domain.ContactKind"},"lastName":{"type":"string"},"mobile":{"type":"string"},"phone":{"type":"string"},"tenant":{"$ref":"#/components/schemas/domain.Tenant"},"tenantId":{"type":"integer"},"title":{"type":"string"},"updatedAt":{"format":"date-time","type":"string"}},"type":"object"},"domain.ContactKind":{"enum":["","PERSON","INTAKE","GROUP"],"type":"string"},"domain.Tenant":{"properties":{"id":{"type":"integer"},"name":{"type":"string"}},"type":"object"},"domain.TenantRole":{"enum":["","ADMIN","MEMBER"],"type":"string"},"domain.KeyScope":{"enum":["","INHERIT"],"type":"string"},"middleware.ErrorResponse":{"properties":{"error":{"$ref":"#/components/schemas/middleware.ErrorBody"}},"type":"object"},"middleware.ErrorBody":{"properties":{"code":{"description":"Code is the stable, machine-readable reason. Clients match on this, not on the message.","type":"string"},"details":{"description":"Details carries structured context where an error has any — a conflict names what it\ncollided with. Absent otherwise."},"message":{"type":"string"}},"type":"object"}}},"paths":{"/v1/keys":{"get":{"description":"Returns the tenant's API keys — their labels, actors and lifetimes, never their secrets.\n\n**Filterable** — `id`, `label`, `ident`, `actorId`, `creatorId`, `expiresAt`, `revokedAt`, `usedAt`,\n`createdAt`.\n\n**Sortable** — `id`, `label`, `ident`, `expiresAt`, `revokedAt`, `usedAt`, `createdAt`.\n\n**Searchable** — `ident`, `label`.\n\n`usedAt` is when the key was last accepted and `revokedAt` when it was withdrawn — keys that are still\nusable are `{\"field\":\"revokedAt\",\"op\":\"isNull\"}`. `revokedAt` is set by `DELETE /v1/keys/{keyId}`.\n","operationId":"listKeys","parameters":[{"description":"JSON filter expression","in":"query","name":"filter","schema":{"type":"string"}},{"description":"Free-text term across ident and label","in":"query","name":"search","schema":{"type":"string"}},{"description":"Comma-separated field:direction terms","in":"query","name":"sort","schema":{"type":"string"}},{"description":"Selection of fields and relations","in":"query","name":"fields","schema":{"type":"string"}},{"description":"Number of entries to skip","in":"query","name":"offset","schema":{"default":0,"type":"integer"}},{"description":"Page size, 1 to 100","in":"query","name":"limit","schema":{"default":100,"type":"integer"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/v1.ListKeysResponse-domain_Key"}}},"description":"OK"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/middleware.ErrorResponse"}}},"description":"Bad Request"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/middleware.ErrorResponse"}}},"description":"Unauthorized"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/middleware.ErrorResponse"}}},"description":"Forbidden"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/middleware.ErrorResponse"}}},"description":"Internal Server Error"}},"summary":"List API keys","tags":["key"]}}}}
```
## Issue an API key
> Issues an API key that acts as the calling actor. \`label\` says what it is for, and \`expiresAt\` when\
> it stops working — the default is 90 days from now and anything beyond a year (plus a small grace\
> for clock drift) is answered with \`400\`.\
> \
> \`expiresAt\` replaces the former \`ttl\`. Sending \`ttl\` is answered with \`400\` rather than ignored, so a\
> caller that still asks for a short-lived key is never handed a 90-day one instead.\
> \
> The answer contains \`secret\`, and this is the \*\*only\*\* time it is shown. Store it before closing the\
> response; a lost secret cannot be recovered, only replaced by a new key.
```json
{"openapi":"3.1.0","info":{"title":"Solvio REST API","version":"1.0.0-beta"},"tags":[{"description":"An **API key** lets a machine act without a user token. A key belongs to an actor: whatever it does,\nit does with that actor's permissions, and every request it makes is attributable.\n\nThe secret is shown **once**, in the answer to its creation, and is never retrievable afterwards —\nonly its hash is stored. Keys expire; a key without an explicit lifetime lasts 90 days, and no key may\nbe issued for longer than a year.\n","name":"key"}],"servers":[{"description":"The host serving this document","url":"/api"}],"security":[{"BearerAuth":[]},{"ApiKeyAuth":[]}],"components":{"securitySchemes":{"BearerAuth":{"description":"Token issued by the central equipme authentication, sent as `Bearer `.","scheme":"bearer","type":"http"},"ApiKeyAuth":{"description":"Static key for machine-to-machine access. Alternative to BearerAuth.","in":"header","name":"X-API-Key","type":"apiKey"}},"schemas":{"v1.AddKeyRequest":{"properties":{"expiresAt":{"format":"date-time","type":"string"},"label":{"type":"string"}},"required":["label"],"type":"object"},"v1.AddKeyResponse":{"properties":{"data":{"$ref":"#/components/schemas/domain.Key"},"secret":{"type":"string"}},"type":"object"},"domain.Key":{"properties":{"actor":{"$ref":"#/components/schemas/domain.User"},"actorId":{"type":"integer"},"createdAt":{"type":"string"},"creator":{"$ref":"#/components/schemas/domain.User"},"creatorId":{"type":"integer"},"expiresAt":{"type":"string"},"id":{"type":"integer"},"ident":{"type":"string"},"label":{"type":"string"},"revokedAt":{"type":"string"},"scopes":{"items":{"$ref":"#/components/schemas/domain.KeyScope"},"type":"array","uniqueItems":false},"usedAt":{"type":"string"}},"type":"object"},"domain.User":{"properties":{"contacts":{"items":{"$ref":"#/components/schemas/domain.Contact"},"type":"array","uniqueItems":false},"id":{"description":"id is the only queryable field — User is an internal/identity entity with no\nuser-facing scoped list; its reads are by-id (Query) or bespoke (identity/contact).","type":"integer"},"realm":{"type":"string"},"sub":{"type":"string"},"tenant":{"$ref":"#/components/schemas/domain.Tenant"},"tenantId":{"type":"integer"},"tenantRole":{"$ref":"#/components/schemas/domain.TenantRole"},"username":{"type":"string"}},"type":"object"},"domain.Contact":{"properties":{"assignmentContext":{"type":"string"},"autoAssign":{"description":"AutoAssign / AssignmentContext drive automated ticket routing. Set today only on\nGROUP-kind contacts via the group endpoints; nil/empty on ordinary contacts.","type":"boolean"},"createdAt":{"format":"date-time","type":"string"},"description":{"type":"string"},"email":{"type":"string"},"firstName":{"type":"string"},"id":{"type":"integer"},"kind":{"$ref":"#/components/schemas/domain.ContactKind"},"lastName":{"type":"string"},"mobile":{"type":"string"},"phone":{"type":"string"},"tenant":{"$ref":"#/components/schemas/domain.Tenant"},"tenantId":{"type":"integer"},"title":{"type":"string"},"updatedAt":{"format":"date-time","type":"string"}},"type":"object"},"domain.ContactKind":{"enum":["","PERSON","INTAKE","GROUP"],"type":"string"},"domain.Tenant":{"properties":{"id":{"type":"integer"},"name":{"type":"string"}},"type":"object"},"domain.TenantRole":{"enum":["","ADMIN","MEMBER"],"type":"string"},"domain.KeyScope":{"enum":["","INHERIT"],"type":"string"},"middleware.ErrorResponse":{"properties":{"error":{"$ref":"#/components/schemas/middleware.ErrorBody"}},"type":"object"},"middleware.ErrorBody":{"properties":{"code":{"description":"Code is the stable, machine-readable reason. Clients match on this, not on the message.","type":"string"},"details":{"description":"Details carries structured context where an error has any — a conflict names what it\ncollided with. Absent otherwise."},"message":{"type":"string"}},"type":"object"}}},"paths":{"/v1/keys":{"post":{"description":"Issues an API key that acts as the calling actor. `label` says what it is for, and `expiresAt` when\nit stops working — the default is 90 days from now and anything beyond a year (plus a small grace\nfor clock drift) is answered with `400`.\n\n`expiresAt` replaces the former `ttl`. Sending `ttl` is answered with `400` rather than ignored, so a\ncaller that still asks for a short-lived key is never handed a 90-day one instead.\n\nThe answer contains `secret`, and this is the **only** time it is shown. Store it before closing the\nresponse; a lost secret cannot be recovered, only replaced by a new key.\n","operationId":"addKey","requestBody":{"content":{"application/json":{"schema":{"oneOf":[{"type":"object"},{"$ref":"#/components/schemas/v1.AddKeyRequest","summary":"request","description":"Key to issue"}]}}},"description":"Key to issue","required":true},"responses":{"201":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/v1.AddKeyResponse"}}},"description":"Created"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/middleware.ErrorResponse"}}},"description":"Bad Request"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/middleware.ErrorResponse"}}},"description":"Unauthorized"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/middleware.ErrorResponse"}}},"description":"Forbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/middleware.ErrorResponse"}}},"description":"Not Found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/middleware.ErrorResponse"}}},"description":"Internal Server Error"}},"summary":"Issue an API key","tags":["key"]}}}}
```
## Revoke an API key
> Revokes an API key. The row is kept for audit with \`revokedAt\` set; authentication with that key is\
> rejected from this point on. Revoking an already-revoked key is idempotent and still answers \`204\`.
```json
{"openapi":"3.1.0","info":{"title":"Solvio REST API","version":"1.0.0-beta"},"tags":[{"description":"An **API key** lets a machine act without a user token. A key belongs to an actor: whatever it does,\nit does with that actor's permissions, and every request it makes is attributable.\n\nThe secret is shown **once**, in the answer to its creation, and is never retrievable afterwards —\nonly its hash is stored. Keys expire; a key without an explicit lifetime lasts 90 days, and no key may\nbe issued for longer than a year.\n","name":"key"}],"servers":[{"description":"The host serving this document","url":"/api"}],"security":[{"BearerAuth":[]},{"ApiKeyAuth":[]}],"components":{"securitySchemes":{"BearerAuth":{"description":"Token issued by the central equipme authentication, sent as `Bearer `.","scheme":"bearer","type":"http"},"ApiKeyAuth":{"description":"Static key for machine-to-machine access. Alternative to BearerAuth.","in":"header","name":"X-API-Key","type":"apiKey"}},"schemas":{"middleware.ErrorResponse":{"properties":{"error":{"$ref":"#/components/schemas/middleware.ErrorBody"}},"type":"object"},"middleware.ErrorBody":{"properties":{"code":{"description":"Code is the stable, machine-readable reason. Clients match on this, not on the message.","type":"string"},"details":{"description":"Details carries structured context where an error has any — a conflict names what it\ncollided with. Absent otherwise."},"message":{"type":"string"}},"type":"object"}}},"paths":{"/v1/keys/{keyId}":{"delete":{"description":"Revokes an API key. The row is kept for audit with `revokedAt` set; authentication with that key is\nrejected from this point on. Revoking an already-revoked key is idempotent and still answers `204`.\n","operationId":"revokeKey","parameters":[{"description":"Key id","in":"path","name":"keyId","required":true,"schema":{"type":"integer"}}],"responses":{"204":{"description":"No Content"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/middleware.ErrorResponse"}}},"description":"Bad Request"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/middleware.ErrorResponse"}}},"description":"Unauthorized"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/middleware.ErrorResponse"}}},"description":"Forbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/middleware.ErrorResponse"}}},"description":"Not Found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/middleware.ErrorResponse"}}},"description":"Internal Server Error"}},"summary":"Revoke an API key","tags":["key"]}}}}
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://hub.equipme.io/development/api-reference-solvio-beta/api-key.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.