CueFrame API Keys API

openapi: 3.2.0
info:
  title: Cueframe Ai API Keys API
  version: v1
  contact:
    name: CueFrame
    url: https://cueframe.ai
    email: support@cueframe.ai
  license:
    name: Apache-2.0
    identifier: Apache-2.0
  description: 'Operations tagged api-keys across 2 of this provider''s published API definitions: cueframe-ai-openapi.json, cueframe-ai-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.cueframe.ai
  description: Production
tags:
- name: API Keys
paths:
  /v1/api-keys:
    post:
      operationId: createApiKey
      tags:
      - API Keys
      summary: Create a scoped API key (session credential only)
      description: Mint an API key with chosen resource permissions and an optional expiry for scripts and integrations; the secret is shown once. Requires a signed-in session, so API keys are refused with 403.
      security:
      - bearerAuth: []
      - oauth2: []
      x-permissions: {}
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApiKeyCreateRequest'
      responses:
        '201':
          description: Key created — the secret is returned ONCE.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiKeyResponse'
        '400':
          description: Bad request — validation_error / invalid_cursor / invalid_query.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '401':
          description: Missing or invalid Authorization header.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '403':
          description: Forbidden — permission insufficient.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '422':
          description: Unprocessable — invalid_composition / media_in_use / session_in_use / render_not_cancellable.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '500':
          description: Internal error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
    servers:
    - url: https://api.cueframe.ai
      description: Production
components:
  schemas:
    ErrorEnvelope:
      type: object
      properties:
        error:
          type: object
          properties:
            code:
              type: string
              description: Stable machine-readable error code per §Error Model.
            message:
              type: string
              description: Human-readable message.
            contract:
              type: string
              description: Contract version that produced this verdict. If it differs between two calls, the rules changed underneath you, not your request.
            contractVersion:
              type: string
              description: 'Version of the published `@cueframe/api-contract` this server implements. Compare it with the `contractVersion` of the package your client was generated from: a higher value here means the server has moved ahead of your document.'
            details:
              description: Optional context (currentEtag, projectIds, retryAfter, …).
              type: object
              propertyNames:
                type: string
              additionalProperties: {}
          required:
          - code
          - message
          - contract
          - contractVersion
          description: Standard API error envelope.
      required:
      - error
      description: Error envelope used by every non-2xx response.
    ApiKeyResponse:
      type: object
      properties:
        key:
          type: string
          description: The full secret key (cf_test_… / cf_live_…). Shown ONCE — store it now.
        id:
          type: string
        prefix:
          type: string
        start:
          type: string
          description: First chars of the key, for later identification.
      required:
      - key
      - id
      - prefix
      - start
      additionalProperties: false
    ApiKeyCreateRequest:
      type: object
      properties:
        name:
          type: string
          minLength: 1
        permissions:
          type: object
          propertyNames:
            type: string
            enum:
            - media
            - sessions
            - projects
            - renders
            - webhooks
            - billing
          additionalProperties:
            minItems: 1
            type: array
            items:
              type: string
              enum:
              - read
              - write
          description: 'Resource → actions grant. Resources: media, sessions, projects, renders, webhooks, billing. Actions: read, write. Least-privilege — grant only what''s needed (billing:write is required to start a checkout).'
        expiresIn:
          description: Lifetime in seconds; omit for no expiry.
          type: integer
          exclusiveMinimum: 0
          maximum: 9007199254740991
      required:
      - name
      - permissions
      additionalProperties: false
  securitySchemes:
    oauth2:
      type: oauth2
      description: Authorization code with PKCE (S256). Request explicit resource scopes for least privilege; identity-only grants retain account-level access.
      flows:
        authorizationCode:
          authorizationUrl: https://api.cueframe.ai/api/auth/mcp/authorize
          tokenUrl: https://api.cueframe.ai/api/auth/mcp/token
          scopes:
            media:read: Read media
            media:write: Modify media
            sessions:read: Read sessions
            sessions:write: Modify sessions
            projects:read: Read projects
            projects:write: Modify projects
            renders:read: Read renders
            renders:write: Modify renders
            webhooks:read: Read webhooks
            webhooks:write: Modify webhooks
            billing:read: Read billing
            billing:write: Modify billing
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: cf_live_* or cf_test_*
      description: API key auth. Prefix `cf_live_` for production orgs, `cf_test_` for sandbox.
    x402:
      type: apiKey
      in: header
      name: PAYMENT-SIGNATURE
      description: x402 v2 payment header (EIP-3009 USDC on Base; base64 PaymentPayload). Returned 402 Payment-Required if absent on priced endpoints.
x-refined-from:
- cueframe-ai-openapi.json
- cueframe-ai-openapi.yml