Skip to main content

ApiKeyMutations

No description

type ApiKeyMutations {
  createApiKey(
    name: String!
    permissions: PermissionsInput!
    expiresAt: ZonedDateTime
    scopes: ApiKeyScopesInput
  ): CreatedApiKey
  createPersonalApiKey(
    name: String!
    permissions: PermissionsInput!
    expiresAt: ZonedDateTime
    scopes: ApiKeyScopesInput
  ): CreatedApiKey
  updateApiKeyPermissions(
    orgApiKeyId: Long!
    permissions: PermissionsInput!
  ): OrgApiKey
  updateApiKeyScopes(
    orgApiKeyId: Long!
    scopes: ApiKeyScopesInput!
  ): OrgApiKey
  rotateApiKey(
    orgApiKeyId: Long!
  ): String
  revokeApiKey(
    orgApiKeyId: Long!
  ): Boolean
}

Fields​

ApiKeyMutations.createApiKey ● CreatedApiKey object​

Create an organization API key (name + explicit GraphQL permission set + optional expiry + optional scopes). Omitting scopes grants GraphQL access only; endpoint scopes (endpoint:invoke per endpoint public id, endpoint:results:read) additionally require canBuildWorkflows. Returns the plaintext key exactly once. Requires canManageApiKeys and selected permissions within your current grants; API-key-authenticated requests can never manage keys.

ApiKeyMutations.createApiKey.name ● String! non-null scalar​
ApiKeyMutations.createApiKey.permissions ● PermissionsInput! non-null input​
ApiKeyMutations.createApiKey.expiresAt ● ZonedDateTime scalar​
ApiKeyMutations.createApiKey.scopes ● ApiKeyScopesInput input​

ApiKeyMutations.createPersonalApiKey ● CreatedApiKey object​

Create a personal API key acting as you within the current organization. Selected GraphQL permissions cannot exceed your current role; authentication intersects them with that role afresh. Omitting scopes grants GraphQL access only; endpoint scopes require canBuildWorkflows. Requires a user session and canCreateApiKeys. Returns plaintext exactly once.

ApiKeyMutations.createPersonalApiKey.name ● String! non-null scalar​
ApiKeyMutations.createPersonalApiKey.permissions ● PermissionsInput! non-null input​
ApiKeyMutations.createPersonalApiKey.expiresAt ● ZonedDateTime scalar​
ApiKeyMutations.createPersonalApiKey.scopes ● ApiKeyScopesInput input​

ApiKeyMutations.updateApiKeyPermissions ● OrgApiKey object​

Replace an API key's permission set within your current grants. Organization keys require canManageApiKeys; personal keys require ownership.

ApiKeyMutations.updateApiKeyPermissions.orgApiKeyId ● Long! non-null scalar​
ApiKeyMutations.updateApiKeyPermissions.permissions ● PermissionsInput! non-null input​

ApiKeyMutations.updateApiKeyScopes ● OrgApiKey object​

Replace an API key's scopes: GraphQL access, the endpoint allowlist (public ids), async result reads and the Endpoints-section limits. Endpoint scopes require canBuildWorkflows; limits may only lower the defaults. Organization keys require canManageApiKeys; personal keys require ownership. Revoking all scopes is refused.

ApiKeyMutations.updateApiKeyScopes.orgApiKeyId ● Long! non-null scalar​
ApiKeyMutations.updateApiKeyScopes.scopes ● ApiKeyScopesInput! non-null input​

ApiKeyMutations.rotateApiKey ● String scalar​

Rotate (cycle) an API key: new key material on the same key (name, permissions and expiry are kept); the old key stops working immediately. Returns the new plaintext key exactly once. Organization keys require canManageApiKeys and all stored grants; personal keys require ownership.

ApiKeyMutations.rotateApiKey.orgApiKeyId ● Long! non-null scalar​

ApiKeyMutations.revokeApiKey ● Boolean scalar​

Soft revoke an API key, retaining its row for provenance; it stops working immediately. Requires canManageApiKeys, or ownership of a personal key.

ApiKeyMutations.revokeApiKey.orgApiKeyId ● Long! non-null scalar​

Returned By​

apiKeys mutation