Connections Api Keys API

openapi: 3.2.0
info:
  title: Connections Icu Api Keys API
  version: 1.0.0
  description: 'Operations tagged Api Keys across 2 of this provider''s published API definitions: connections-icu-studio-openapi-original.json, connections-icu-studio-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://studio.connectionsapi.com
tags:
- name: API Keys
paths:
  /v1/api-keys:
    get:
      summary: List your API keys in the active project (?project=; a key defaults to its OWN…
      security:
      - aegisBearer: []
      - apiKey: []
      tags:
      - API Keys
      operationId: getV1ApiKeys
      x-operation-id-source: derived
    post:
      summary: Mint a scoped key - the secret is returned once.
      security:
      - aegisBearer: []
      - apiKey: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
              - label
              properties:
                label:
                  type: string
                  description: REQUIRED. Your own name for the key, trimmed to 80 characters.
                  maxLength: 80
                scopes:
                  type: array
                  items:
                    type: string
                  description: Scopes to grant. Bounded by what your own tier and principal may delegate; ping /v1/me for yours.
                tier:
                  type: string
                  description: '''pub'' mints a PUBLISHABLE key (browser-safe). Any other value - absent, ''live'', a typo - mints a live key.'
                  enum:
                  - pub
                  - live
                allowedOrigins:
                  type: array
                  items:
                    type: string
                  description: Browser origins allowed to use this key. Tier-bounded.
                allowedIps:
                  type: array
                  items:
                    type: string
                  description: IPs or CIDRs allowed to use this key.
                appId:
                  type: string
                  description: 'Bind the key to one of your OAuth apps. Alias: appClientId.'
      tags:
      - API Keys
      operationId: postV1ApiKeys
      x-operation-id-source: derived
    servers:
    - url: https://studio.connectionsapi.com
  /v1/api-keys/{id}/secret:
    get:
      summary: Re-reveal a key you own. - session, or key with keys:write
      security:
      - aegisBearer: []
      - apiKey: []
      parameters:
      - name: id
        in: path
        required: true
        schema:
          type: string
      tags:
      - API Keys
      operationId: getV1ApiKeysByIdSecret
      x-operation-id-source: derived
    servers:
    - url: https://studio.connectionsapi.com
  /v1/api-keys/{id}:
    patch:
      summary: Restrict a key - edit its scopes (API restrictions) and/or label.
      security:
      - aegisBearer: []
      - apiKey: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              description: A PATCH - send only what changes. Exactly one of scopes / allowedOrigins / allowedIps is applied per call, in that order.
              properties:
                label:
                  type: string
                  description: A blank or non-string label is ignored rather than applied.
                  maxLength: 80
                scopes:
                  type: array
                  items:
                    type: string
                  description: Replaces the key's scopes. De-duplicated; tier-bounded.
                  x-setting:
                    id: studio.api_key_scopes
                    label: API key scopes
                    synonyms:
                    - key permissions
                    - api restrictions
                    - key access
                    - restrict key
                    scope: api_key
                    group: 'Developer console: API keys'
                    scopeParam: id
                allowedOrigins:
                  type: array
                  items:
                    type: string
                  description: Replaces the browser-origin allowlist. A publishable key keeps at least one.
                  x-setting:
                    id: studio.api_key_allowed_origins
                    label: API key allowed websites
                    synonyms:
                    - allowed origins
                    - key domains
                    - cors origins
                    - browser origins
                    scope: api_key
                    group: 'Developer console: API keys'
                    scopeParam: id
                allowedIps:
                  type: array
                  items:
                    type: string
                  description: Replaces the IP allowlist.
      parameters:
      - name: id
        in: path
        required: true
        schema:
          type: string
      tags:
      - API Keys
      operationId: patchV1ApiKeysById
      x-operation-id-source: derived
    delete:
      summary: Revoke a key.
      security:
      - aegisBearer: []
      - apiKey: []
      parameters:
      - name: id
        in: path
        required: true
        schema:
          type: string
      tags:
      - API Keys
      operationId: deleteV1ApiKeysById
      x-operation-id-source: derived
    servers:
    - url: https://studio.connectionsapi.com
components:
  securitySchemes:
    aegisBearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: The AEGIS SSO access token (Cognito JWT from the shared sign-in) presented as a Bearer on every /v1 call.
    apiKey:
      type: http
      scheme: bearer
      bearerFormat: cnx_live_* | cnx_pub_*
      description: 'A key minted in the console, sent as a bearer token. `cnx_live_` carries cross-plane data scopes AND (when granted) Studio management scopes (apps:*, keys:*, projects:*, webhooks:*) that authorize the console-management operations below. `cnx_pub_` is the publishable, browser-safe tier (Stripe''s pk_ model): mint-time capped to :read scopes, requires a non-empty allowed-origins allowlist, refused on any non-GET/HEAD route, and rate-limited - safe to embed in client-side code.'
    oauthUserToken:
      type: http
      scheme: bearer
      description: EITHER (a) a Sign-in-with-Connections USER access token issued by accounts.connectionsapi.com to a registered OAuth app - the app acts on behalf of its signed-in user, rows are keyed by the token's own sub + client_id; OR (b) an app-bound publishable key (cnx_pub_, minted with an appId) presented on X-Connections-Api-Key ALONGSIDE the signed-in user's own plain AEGIS bearer on Authorization - the server derives (app_id, sub) from the two verified credentials. The publishable key alone authorizes nothing; both credentials are required. This second form is for a developer who wants the locker without standing up a full OAuth client - mint one publishable key bound to a registered app instead.
x-refined-from:
- connections-icu-studio-openapi-original.json
- connections-icu-studio-openapi.yml