List API keys
GET /api/api-keys
Needs an Admin key.
Every key made on the API Keys page or with this API, newest first. The key itself is never shown again; prefix identifies it.
Replies
| Status | Meaning | Body |
|---|---|---|
| 200 | OK | list of ApiKeyView |
Reply fields
| Field | Type | Description |
|---|---|---|
id |
string | The key's identifier, used to revoke it. Always present. |
name |
string | The name given to the key when it was created. Always present. |
role |
string | What the key may do: Admin (read and change), Viewer (read only) or Tenant (one tenant's own sites). Always present. |
tenantId |
string | For a Tenant key, the tenant it is limited to. Null for other keys. |
prefix |
string | The first characters of the key, to tell keys apart. It cannot be used to sign in. Always present. |
createdAt |
date-time | When the key was created. Always present. |
lastUsedAt |
date-time | When the key was last used. Null if it never has been. |
revoked |
boolean | True when the key has been revoked and no longer works. Always present. |
Create an API key
POST /api/api-keys
Needs an Admin key.
role is Admin, Viewer or Tenant; a Tenant key also needs tenantId. The reply's key is shown this once only.
Request body: CreateApiKeyRequest
| Field | Type | Description |
|---|---|---|
name |
string | A name to recognise the key by, 1 to 80 characters. Required. Optional. |
role |
string | What the key may do: Admin (read and change), Viewer (read only) or Tenant (one tenant's own sites). Required. Optional. |
tenantId |
string | The tenant a Tenant key is limited to. Required for role Tenant; ignored for other roles. Optional. |
Replies
| Status | Meaning | Body |
|---|---|---|
| 200 | OK | ApiKeyCreated |
| 400 | Bad Request | ApiError |
Reply fields
| Field | Type | Description |
|---|---|---|
id |
string | The key's identifier, used to revoke it. Always present. |
name |
string | The name given to the key. Always present. |
role |
string | What the key may do: Admin, Viewer or Tenant. Always present. |
tenantId |
string | For a Tenant key, the tenant it is limited to. Null for other keys. |
prefix |
string | The first characters of the key, which also show in the key list. Always present. |
key |
string | The full key. It is shown this once only and cannot be recovered; copy it now or create another. Always present. |
Revoke an API key
POST /api/api-keys/{id}/revoke
Needs an Admin key.
The key stops working at once.
Parameters
| Name | In | Type | Notes |
|---|---|---|---|
id |
path | string | Required. |
Replies
| Status | Meaning | Body |
|---|---|---|
| 200 | OK | OkResult |
| 404 | Not Found | ApiError |
Reply fields
| Field | Type | Description |
|---|---|---|
ok |
boolean | Always true when the request was carried out. Always present. |
Updated 2026-10-27Something unclear or missing? Tell us.