API keys
Metadata for your keys. Only the display prefix is returned, never the secret. Cursor-paginated, newest first. limit accepts 1 to 100 and defaults to 20. To walk further, set starting_after to the id of the last record on the page you just read. has_more tells you another page exists and next_cursor is the value to pass back; on the last page has_more is false and next_cursor is null. An unknown cursor is ignored and you get the first page. Key ids are UUIDs, so starting_after takes a UUID here rather than a prefixed id. Requires the settings:read permission on the calling key.
Authorization
secretKey Secret API key, e.g. kyc_live_... (server-side) or kyc_test_... (sandbox).
In: header
Query Parameters
How many records to return. 1 to 100, defaults to 20.
1 <= value <= 10020An API key id; returns the page after it.
uuidResponse Body
application/json
application/json
application/json
application/json
application/json
application/json
curl -X GET "https://example.com/v1/api-keys"{ "object": "list", "data": [ { "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "object": "api_key", "name": "string", "environment": "live", "status": "active", "key_prefix": "string", "permissions": [ "verification:create" ], "created_at": "2019-08-24T14:15:22Z", "last_used_at": "2019-08-24T14:15:22Z", "expires_at": "2019-08-24T14:15:22Z", "revoked_at": "2019-08-24T14:15:22Z" } ], "has_more": true, "next_cursor": "string"}Mint a new secret key. The response carries secret_key exactly once: it is stored hashed and is not recoverable, so capture it now. environment decides whether the key runs in sandbox (test) or live. Omitting permissions gives the key the default permission set.
Requires the settings:write permission on the calling key.
Authorization
secretKey Secret API key, e.g. kyc_live_... (server-side) or kyc_test_... (sandbox).
In: header
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
application/json
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/v1/api-keys" \ -H "Content-Type: application/json" \ -d '{ "name": "string", "environment": "live" }'{ "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "object": "api_key", "name": "string", "environment": "live", "status": "active", "key_prefix": "string", "permissions": [ "verification:create" ], "created_at": "2019-08-24T14:15:22Z", "last_used_at": "2019-08-24T14:15:22Z", "expires_at": "2019-08-24T14:15:22Z", "revoked_at": "2019-08-24T14:15:22Z", "secret_key": "string"}Revokes the key immediately. The row is kept for audit, so the response is the key resource with status set to revoked and revoked_at populated, not a deletion marker. A revoked key can never be reactivated. Revoking the key you are calling with will lock you out.
Requires the settings:write permission on the calling key.
Authorization
secretKey Secret API key, e.g. kyc_live_... (server-side) or kyc_test_... (sandbox).
In: header
Path Parameters
The key id. API key ids are UUIDs, not prefixed ids.
uuidResponse Body
application/json
application/json
application/json
application/json
application/json
application/json
application/json
curl -X DELETE "https://example.com/v1/api-keys/497f6eca-6276-4993-bfeb-53cbbbba6f08"{ "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "object": "api_key", "name": "string", "environment": "live", "status": "active", "key_prefix": "string", "permissions": [ "verification:create" ], "created_at": "2019-08-24T14:15:22Z", "last_used_at": "2019-08-24T14:15:22Z", "expires_at": "2019-08-24T14:15:22Z", "revoked_at": "2019-08-24T14:15:22Z"}