# API credentials (/docs/reference/roles-permissions/credential)



API-key permissions are baseline tenant-member capabilities. These operations are restricted to the caller's own keys in the active tenant. They do not provide a tenant-wide credential-administration role.

A key is bound to its owner and tenant. It does not grant a new functional role or make the owner's resource-access checks disappear. Existing secrets are masked and cannot be retrieved through the key-detail operation.

## Permissions [#permissions]

This family contains **4 permissions**. “Baseline member” means every current tenant member already has the operation permission, including members with any system role. It does not bypass the resource checks described above. “Custom role” means the identifier can be selected when defining a custom role.

<Catalogue>
  <details className="catalogue-entry">
    <summary>
      ### credential.api\_key.create [#credentialapi_keycreate]

      <span className="catalogue-description">
        Create a personal API key bound to the active tenant.
      </span>
    </summary>

    <div className="catalogue-content">
      Create a personal API key bound to the active tenant. Its secret is returned once at creation.

      | Property    | Value                                                                                        |
      | ----------- | -------------------------------------------------------------------------------------------- |
      | Scope       | Selected tenant                                                                              |
      | Granted by  | [Baseline member](/docs/reference/roles-permissions/system-roles#baseline-tenant-membership) |
      | Custom role | Yes                                                                                          |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### credential.api\_key.list [#credentialapi_keylist]

      <span className="catalogue-description">
        List the caller's API keys in the selected tenant, with masked secrets.
      </span>
    </summary>

    <div className="catalogue-content">
      List the caller's API keys in the selected tenant, with masked secrets.

      | Property    | Value                                                                                        |
      | ----------- | -------------------------------------------------------------------------------------------- |
      | Scope       | Selected tenant                                                                              |
      | Granted by  | [Baseline member](/docs/reference/roles-permissions/system-roles#baseline-tenant-membership) |
      | Custom role | Yes                                                                                          |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### credential.api\_key.manage [#credentialapi_keymanage]

      <span className="catalogue-description">
        Read one of the caller's API-key records by ID.
      </span>
    </summary>

    <div className="catalogue-content">
      Read one of the caller's API-key records by ID. Despite its name, this is not authority to manage other users' keys or recover an existing secret.

      | Property    | Value                                                                                        |
      | ----------- | -------------------------------------------------------------------------------------------- |
      | Scope       | Selected tenant                                                                              |
      | Granted by  | [Baseline member](/docs/reference/roles-permissions/system-roles#baseline-tenant-membership) |
      | Custom role | Yes                                                                                          |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### credential.api\_key.revoke [#credentialapi_keyrevoke]

      <span className="catalogue-description">
        Revoke one of the caller's API keys in the selected tenant.
      </span>
    </summary>

    <div className="catalogue-content">
      Revoke one of the caller's API keys in the selected tenant.

      | Property    | Value                                                                                        |
      | ----------- | -------------------------------------------------------------------------------------------- |
      | Scope       | Selected tenant                                                                              |
      | Granted by  | [Baseline member](/docs/reference/roles-permissions/system-roles#baseline-tenant-membership) |
      | Custom role | Yes                                                                                          |
    </div>
  </details>
</Catalogue>

## Related pages [#related-pages]

* [Roles and permissions catalogue](/docs/reference/roles-permissions)
* [System roles and baseline access](/docs/reference/roles-permissions/system-roles)