API credentials
Personal, tenant-bound API keys.
API-key permissions are baseline tenant-member capabilities. These operations are restricted to the caller's own keys in the active tenant. They do not provide a tenant-wide credential-administration role.
A key is bound to its owner and tenant. It does not grant a new functional role or make the owner's resource-access checks disappear. Existing secrets are masked and cannot be retrieved through the key-detail operation.
Permissions
This family contains 4 permissions. “Baseline member” means every current tenant member already has the operation permission, including members with any system role. It does not bypass the resource checks described above. “Custom role” means the identifier can be selected when defining a custom role.
credential.api_key.create
Create a personal API key bound to the active tenant.
Create a personal API key bound to the active tenant. Its secret is returned once at creation.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | Baseline member |
| Custom role | Yes |
credential.api_key.list
List the caller's API keys in the selected tenant, with masked secrets.
List the caller's API keys in the selected tenant, with masked secrets.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | Baseline member |
| Custom role | Yes |
credential.api_key.manage
Read one of the caller's API-key records by ID.
Read one of the caller's API-key records by ID. Despite its name, this is not authority to manage other users' keys or recover an existing secret.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | Baseline member |
| Custom role | Yes |
credential.api_key.revoke
Revoke one of the caller's API keys in the selected tenant.
Revoke one of the caller's API keys in the selected tenant.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | Baseline member |
| Custom role | Yes |