Antfly API Key API

openapi: 3.2.0
info:
  title: Antfly Public API Key API
  version: v1alpha1
  description: Joined public contract for the Antfly server. Antfly APIs are served under `/db/v1`, auth APIs under `/auth/v1`, inference APIs under `/ai/v1`, ML prediction APIs under `/ml/v1`, and extension lifecycle APIs under `/extensions/v1`.
servers:
- url: /
security:
- BasicAuth: []
- ApiKeyAuth: []
- BearerAuth: []
tags:
- name: API Key
  x-displayName: API Key
  description: Operations related to API key management
paths:
  /auth/v1/users/{userName}/api-keys:
    parameters:
    - $ref: '#/components/parameters/UserNamePathParameter'
    get:
      tags:
      - API Key
      summary: List API keys for a user
      description: Returns all API keys owned by the specified user. Secrets are never included.
      operationId: listApiKeys
      responses:
        '200':
          description: Successful operation
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/ApiKey'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: User not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Internal Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      security:
      - BasicAuth: []
      - ApiKeyAuth: []
      - BearerAuth: []
    post:
      tags:
      - API Key
      summary: Create a new API key
      description: Creates a new API key for the specified user. The cleartext secret is returned only in this response.
      operationId: createApiKey
      requestBody:
        description: API key creation details
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateApiKeyRequest'
      responses:
        '201':
          description: API key created successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiKeyWithSecret'
        '400':
          description: Bad Request (e.g., invalid input)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: Forbidden (e.g., requested permissions exceed creator's permissions)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: User not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Internal Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      security:
      - BasicAuth: []
      - ApiKeyAuth: []
      - BearerAuth: []
  /auth/v1/users/{userName}/api-keys/{keyId}:
    parameters:
    - $ref: '#/components/parameters/UserNamePathParameter'
    - $ref: '#/components/parameters/KeyIdPathParameter'
    delete:
      tags:
      - API Key
      summary: Delete an API key
      description: Permanently deletes the specified API key. Subsequent requests using this key will be rejected.
      operationId: deleteApiKey
      responses:
        '204':
          description: API key deleted successfully
        '404':
          description: API key not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Internal Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      security:
      - BasicAuth: []
      - ApiKeyAuth: []
      - BearerAuth: []
components:
  schemas:
    ScopedRowFilter:
      type: object
      properties:
        table_target:
          $ref: '#/components/schemas/CatalogTableScope'
        filter:
          type: object
          additionalProperties: {}
      required:
      - table_target
      - filter
    ApiKey:
      type: object
      description: Public metadata for an API key (secrets are never returned after creation).
      properties:
        key_id:
          type: string
          description: Unique identifier for the API key.
          example: aBcDeFgHiJkLmNoPqRsT
        name:
          type: string
          description: Human-readable name for the API key.
          example: CI pipeline key
        username:
          type: string
          description: Owner of the API key.
          example: johndoe
        permissions:
          type:
          - array
          - 'null'
          items:
            $ref: '#/components/schemas/Permission'
          description: Optional permission scoping. If empty, inherits owner's full permissions.
        scoped_row_filters:
          type: array
          items:
            $ref: '#/components/schemas/ScopedRowFilter'
        row_filter:
          type:
          - object
          - 'null'
          additionalProperties: {}
          description: 'Optional per-table row filter. Keys are table names (or ''*'' for all tables). Values are Antfly query JSON objects. API keys inherit the owner''s effective row filters; key-local filters are applied as additional narrowing.

            '
        created_at:
          type: string
          format: date-time
          description: When the API key was created.
        expires_at:
          type:
          - string
          - 'null'
          format: date-time
          description: When the API key expires. Null means never.
      required:
      - key_id
      - name
      - username
      - created_at
    ApiKeyWithSecret:
      description: API key creation response including the cleartext secret (shown once).
      allOf:
      - $ref: '#/components/schemas/ApiKey'
      - type: object
        properties:
          key_secret:
            type: string
            description: Cleartext secret for the API key. Store securely — it cannot be retrieved again.
            example: dGhpcyBpcyBhIHNlY3JldA
          encoded:
            type: string
            description: 'Pre-encoded credential ready for the Authorization header: base64(key_id:key_secret).'
            example: YUJjRGVGZ0hpSmtMbU5vUHFSc1Q6ZEdocGN5QnBjeUJoSUhObFkzSmxkQQ==
        required:
        - key_secret
        - encoded
    Permission:
      type: object
      description: Specify exactly one of a legacy literal resource or a structured table_target; table_target requires resource_type table.
      properties:
        resource:
          type: string
          description: Resource name (e.g., table name, target username, or '*' for all inference operations or a global grant).
          example: orders_table
        table_target:
          $ref: '#/components/schemas/CatalogTableScope'
        resource_type:
          $ref: '#/components/schemas/ResourceType'
        type:
          $ref: '#/components/schemas/PermissionType'
      required:
      - resource_type
      - type
    CatalogTableScope:
      type: object
      description: A table or all tables in an explicit namespace. A missing table selects the namespace; a table named '*' remains literal.
      properties:
        database:
          type: string
          default: default
        namespace:
          type: string
          default: public
        table:
          type: string
      additionalProperties: false
    Error:
      type: object
      properties:
        code:
          type: string
          description: Optional stable machine-readable error code for programmatic handling.
        error:
          type: string
          example: An error message
          description: Legacy human-readable error text.
        message:
          type: string
          description: Human-readable error description when supplied by the endpoint.
        retryable:
          type: boolean
          description: Whether retrying the operation may succeed without changing the request.
        retry_after_ms:
          type: integer
          format: int32
          minimum: 1
          description: Suggested minimum retry delay in milliseconds.
      required:
      - error
    ResourceType:
      type: string
      enum:
      - table
      - database
      - namespace
      - tablespace
      - user
      - inference
      - '*'
      description: 'Type of resource: table, user, inference, or global (''*''). Use inference with resource ''*'' to grant access to unified inference routes.'
      example: table
    PermissionType:
      type: string
      enum:
      - read
      - write
      - curator
      - admin
      description: Type of permission.
      example: read
    CreateApiKeyRequest:
      type: object
      description: Request to create a new API key.
      properties:
        name:
          type: string
          description: Human-readable name for the API key.
          example: CI pipeline key
        expires_in:
          type: string
          description: Duration until expiration (e.g., '720h' for 30 days). Empty means never.
          example: 720h
        permissions:
          type:
          - array
          - 'null'
          items:
            $ref: '#/components/schemas/Permission'
          description: Optional permission scoping. Each permission must be a subset of the creator's permissions.
        scoped_row_filters:
          type: array
          items:
            $ref: '#/components/schemas/ScopedRowFilter'
        row_filter:
          type:
          - object
          - 'null'
          additionalProperties: {}
          description: 'Optional per-table row filter. Keys are table names (or ''*'' for all tables). Values are Antfly query JSON objects. API keys inherit the owner''s effective row filters; key-local filters are applied as additional narrowing.

            '
      required:
      - name
  parameters:
    KeyIdPathParameter:
      name: keyId
      in: path
      required: true
      description: The API key ID.
      schema:
        type: string
        example: aBcDeFgHiJkLmNoPqRsT
    UserNamePathParameter:
      name: userName
      in: path
      required: true
      description: The username.
      schema:
        type: string
        example: johndoe
  securitySchemes:
    BasicAuth:
      type: http
      scheme: basic
    ApiKeyAuth:
      type: apiKey
      in: header
      name: Authorization
    BearerAuth:
      type: http
      scheme: bearer
x-tagGroups:
- name: Antfly
  tags:
  - cluster_management
  - table_management
  - data_operations
  - query_operations
  - index_management
- name: Auth
  tags:
  - User
  - Permission
  - ApiKey
  - RowFilter
- name: Inference
  tags: []
- name: Extensions
  tags:
  - Packages
  - Installed