Exoscale ai-api-key API
The ai-api-key API from Exoscale — 3 operation(s) for ai-api-key.
OpenAPI Specification
openapi: 3.0.0
info:
version: 2.0.0
termsOfService: https://exoscale.com/terms
contact:
email: support@exoscale.com
name: Exoscale Support
url: https://portal.exoscale.com/tickets
title: Exoscale ai-api-key API
description: Infrastructure automation API, allowing programmatic access to all Exoscale products and services.
servers:
- url: https://api-{zone}.exoscale.com/v2
variables:
zone:
default: ch-gva-2
enum:
- ch-gva-2
- ch-dk-2
- de-fra-1
- de-muc-1
- at-vie-1
- at-vie-2
- bg-sof-1
- hr-zag-1
tags:
- name: ai-api-key
paths:
/ai/ai-api-key:
get:
tags:
- ai-api-key
responses:
'403':
description: '403'
content:
application/json:
schema:
$ref: '#/components/schemas/forbidden-operation-response'
'200':
description: '200'
content:
application/json:
schema:
$ref: '#/components/schemas/list-ai-api-keys-response'
description: List AI API keys for an organization
parameters: []
summary: List AI API Keys
operationId: list-ai-api-keys
post:
tags:
- ai-api-key
responses:
'403':
description: '403'
content:
application/json:
schema:
$ref: '#/components/schemas/forbidden-operation-response'
'404':
description: '404'
content:
application/json:
schema:
$ref: '#/components/schemas/error-response'
'200':
description: '200'
content:
application/json:
schema:
$ref: '#/components/schemas/ai-api-key-with-value'
'400':
description: '400'
content:
application/json:
schema:
$ref: '#/components/schemas/error-response'
description: Create a new AI API key
parameters: []
summary: Create AI API Key
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/create-ai-api-key-request'
operationId: create-ai-api-key
/ai/ai-api-key/{id}:
delete:
tags:
- ai-api-key
responses:
'403':
description: '403'
content:
application/json:
schema:
$ref: '#/components/schemas/forbidden-operation-response'
'404':
description: '404'
content:
application/json:
schema:
$ref: '#/components/schemas/error-response'
'200':
description: '200'
content:
application/json:
schema:
properties:
deleted:
type: boolean
type: object
required:
- deleted
description: Delete AI API key
parameters:
- in: path
required: true
name: id
schema:
type: string
format: uuid
summary: Delete AI API Key
operationId: delete-ai-api-key
get:
tags:
- ai-api-key
responses:
'403':
description: '403'
content:
application/json:
schema:
$ref: '#/components/schemas/forbidden-operation-response'
'404':
description: '404'
content:
application/json:
schema:
$ref: '#/components/schemas/error-response'
'200':
description: '200'
content:
application/json:
schema:
$ref: '#/components/schemas/ai-api-key'
description: Get AI API key metadata
parameters:
- in: path
required: true
name: id
schema:
type: string
format: uuid
summary: Get AI API Key
operationId: get-ai-api-key
patch:
tags:
- ai-api-key
responses:
'403':
description: '403'
content:
application/json:
schema:
$ref: '#/components/schemas/forbidden-operation-response'
'404':
description: '404'
content:
application/json:
schema:
$ref: '#/components/schemas/error-response'
'200':
description: '200'
content:
application/json:
schema:
$ref: '#/components/schemas/ai-api-key'
'400':
description: '400'
content:
application/json:
schema:
$ref: '#/components/schemas/error-response'
description: Update AI API key name and/or scope
parameters:
- in: path
required: true
name: id
schema:
type: string
format: uuid
summary: Update AI API Key
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/update-ai-api-key-request'
operationId: update-ai-api-key
/ai/ai-api-key/{id}/rotate:
post:
tags:
- ai-api-key
responses:
'403':
description: '403'
content:
application/json:
schema:
$ref: '#/components/schemas/forbidden-operation-response'
'404':
description: '404'
content:
application/json:
schema:
$ref: '#/components/schemas/error-response'
'200':
description: '200'
content:
application/json:
schema:
$ref: '#/components/schemas/ai-api-key-with-value'
description: Rotate AI API key value
parameters:
- in: path
required: true
name: id
schema:
type: string
format: uuid
summary: Rotate AI API Key
operationId: rotate-ai-api-key
components:
schemas:
ai-api-key:
description: AI API key metadata (without value)
properties:
updated-at:
description: Last update timestamp
format: date-time
type: string
readOnly: true
name:
description: Human-readable name for the AI API key
type: string
scope:
description: 'Key scope: ''public'' for all deployments, or a specific deployment UUID'
type: string
id:
description: AI API key ID
format: uuid
type: string
readOnly: true
org-uuid:
description: Organization UUID that owns this key
format: uuid
type: string
readOnly: true
created-at:
description: Creation timestamp
format: date-time
type: string
readOnly: true
type: object
list-ai-api-keys-response:
description: List of AI API keys
properties:
ai-api-keys:
type: array
items:
$ref: '#/components/schemas/ai-api-key'
type: object
example:
ai-api-keys:
- updated-at: '2026-03-25T10:00:00Z'
name: default-public-key
scope: public
id: 11111111-1111-1111-1111-111111111111
org-uuid: 22222222-2222-2222-2222-222222222222
created-at: '2026-03-25T10:00:00Z'
required:
- ai-api-keys
update-ai-api-key-request:
description: Request to update an AI API key (at least one property required)
properties:
name:
description: Human-readable name for the AI API key
type: string
scope:
description: 'Key scope: ''public'' for all deployments, or a specific deployment UUID'
type: string
type: object
minProperties: 1
error-response:
type: object
description: RFC 9457 Problem Details error response
required:
- type
- title
- status
- detail
properties:
type:
type: string
format: uri-reference
title:
type: string
status:
type: integer
minimum: 100
maximum: 599
detail:
type: string
instance:
type: string
format: uri-reference
errors:
type: array
items:
type: object
properties:
path:
type: string
detail:
type: string
pointer:
type: string
location:
type: string
forbidden-operation-response:
description: Forbidden operation response
properties:
code:
description: Machine-readable forbidden error code
enum:
- forbidden_operation
type: string
readOnly: true
error:
description: Forbidden error message
type: string
readOnly: true
type: object
required:
- error
- code
create-ai-api-key-request:
description: Request to create a new AI API key
properties:
name:
description: Human-readable name for the AI API key
type: string
scope:
description: 'Key scope: ''public'' for all deployments, or a specific deployment UUID'
type: string
type: object
required:
- name
- scope
ai-api-key-with-value:
description: AI API key with plaintext value
allOf:
- $ref: '#/components/schemas/ai-api-key'
- properties:
value:
description: Plaintext AI API key value (returned only on create/rotate)
type: string
type: object
required:
- value
type: object
x-topics:
- title: API Request Signature
content: '
In order to authenticate legitimate users, the Exoscale API requires incoming requests to be signed using valid Exoscale API account credentials with the following mechanism.
## Signature Mechanism
The *message* (i.e. content) to sign contains several segments concatenated using a line return character (`\n`).
All segments must be included and in the described order. For cases where a segment doesn''t fit the context of the request (e.g. no request body) **an empty line must be used instead**.
* Request method and request URL (path only), separated by a space character
* Request body
* Request URL parameters (Query String) values, concatenated without separator. The matching parameter names have to be specified in the resulting signature header `signed-query-args=` pragma, separated by semicolons (e.g. `p1;p2;pN`).
* Request header values, concatenated without separator (none at the moment, leave empty)
* Request expiration date in UNIX timestamp format
Example *message* to sign for `GET /v2/resource/a02baf5a-a3e4-49a0-857b-8a08d276c1c0?p1=v1&p2=v2`:
```
GET /v2/resource/a02baf5a-a3e4-49a0-857b-8a08d276c1c0
v1v2
1599140767
```
The two blank lines above are due to the absence of a request body and signed headers.
Example *message* to [create a security group](https://community.exoscale.com/reference/api/compute/security-group/#create-security-group)
```
POST /v2/security-group
{"name": "my-security-group"}
1599140767
```
The two blank lines above are due to the absence of query parameters and signed headers.
The request signature consists of the base64-encoded [HMAC](https://en.wikipedia.org/wiki/HMAC) hash of the UTF-8 encoded *message* and the Exoscale API secret using the SHA265 function:
```
signature = BASE64_ENCODE(HMAC_SHA256(Exoscale API secret, message))
```
Finally, the computed signature must be added to the API request in a `Authorization` header such as:
```
Authorization: EXO2-HMAC-SHA256 credential=<Exoscale API key>,expires=<expiration date UNIX timestamp>,signature=<signature>
```
Example API query:
```
GET /v2/resource/a02baf5a-a3e4-49a0-857b-8a08d276c1c0?p1=v1&p2=v2 HTTP/1.1
Host: api-ch-gva-2.exoscale.com
Authorization: EXO2-HMAC-SHA256 credential=EXO29147e9f89102b7ac1e88514,signed-query-args=p1;p2,expires=1599140767,signature=2AOBQsbElQb4FpKT/FM/9T4NobjlmZkSGvvdUth/xlY=
```
## Reference Implementations
You can look up the following existing reference implementations:
* Go: [github.com/exoscale/egoscale/api/v2 > `SecurityProviderExoscale.signRequest`](https://github.com/exoscale/egoscale/blob/master/v2/api/security.go)
* Python: [requests-exoscale-auth > `ExoscaleV2Auth`](https://github.com/exoscale/requests-exoscale-auth/blob/master/exoscale_auth.py)
'
- title: Zone local resources
content: '
The API is deployed across all Exoscale zones. When performing a compute call, you should use the relevant zone for your resource.
For example: https://api-de-fra-1.exoscale.com/v2/instance would return only the instances from `de-fra-1`, https://api-ch-gva-2.exoscale.com/v2/instance from `ch-gva-2`.
To obtain a list of all instances across all zones, you would need to do the corresponding request for each zone.
'