Goosy Bear Keys API
The keys API from Goosy Bear — 1 operation(s) for keys.
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/goosybear-ai:goosybear-ai-keys-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
title: Goosybear Ai Keys API
version: 1.0.0-beta
description: 'Operations tagged keys across 2 of this provider''s published API definitions: goosybear-ai-openapi.json, goosybear-ai-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://app.goosybear.ai
description: Production
security:
- tenantApiKey: []
tags:
- name: Keys
paths:
/api/v1/tools/keys.rotate:
post:
operationId: call_keys_rotate
summary: Call keys.rotate
description: Propose, then confirm, replacing the API key making this call with a new one — 'rotate this key', 'swap in a fresh credential'. The current key keeps working for overlap_hours after the new key exists, then stops. The new key comes back once, on the confirm, so store it before anything else. Not for any other key — revoke or rotate those in Settings › API & MCP.
tags:
- Keys
parameters:
- name: x-request-id
in: header
required: false
description: 'Your own id for this request, echoed back and recorded on the audit trail. 1–128 characters from `A–Z a–z 0–9 . _ : -`, starting with a letter or digit; anything else is replaced by a generated id.'
schema:
type: string
maxLength: 128
requestBody:
required: false
content:
application/json:
schema:
type: object
properties:
overlap_hours:
description: How many hours the current key keeps working after the new one exists, 0 to 168. Default 24.
type: integer
minimum: 0
maximum: 168
confirmation_id:
type: string
format: uuid
pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$
additionalProperties: false
responses:
'200':
description: The call was admitted and dispatched. `ok` says whether the tool succeeded — a refusal the tool itself produced is still a 200, exactly as it is a successful JSON-RPC result over MCP.
headers:
x-goosy-api:
description: Present while this API is in beta; the value is `beta`.
schema:
type: string
const: beta
x-request-id:
description: 'This request''s id: the `x-request-id` you sent when it was well formed, otherwise one generated for you. Quote it to support; it is recorded on every audit row the call wrote.'
schema:
type: string
RateLimit-Limit:
description: Requests this key may make in a rolling minute.
schema:
type: integer
minimum: 1
RateLimit-Remaining:
description: Requests left in the current rolling minute.
schema:
type: integer
minimum: 0
RateLimit-Reset:
description: Whole seconds until the window frees more requests.
schema:
type: integer
minimum: 1
x-goosy-tool-error:
description: '`true` whenever the call did not succeed, including when the tool itself returned a typed `ok: false` — this tool runs at account level, so there is no workspace boundary to distinguish. **Branch on `ok` in the body for the outcome; this header is the transport-level hint.**'
schema:
type: string
enum:
- 'true'
- 'false'
content:
application/json:
schema:
oneOf:
- type: object
description: The tool ran and answered.
properties:
ok:
type: boolean
const: true
state:
type: string
enum:
- confirmation_required
- rotated
overlap_hours:
type: integer
previous_key_prefix:
type: string
confirmation_id:
type: string
format: uuid
pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$
expires_in_seconds:
type: integer
exclusiveMinimum: 0
key:
type: string
key_prefix:
type: string
key_expires_at:
type:
- string
- 'null'
previous_key_expires_at:
type: string
required:
- ok
- overlap_hours
- previous_key_prefix
- state
- $ref: '#/components/schemas/ToolRefusal'
'400':
description: 'The request could not be used: the body is present but not a JSON object (`tenant_api.malformed_body`); it is a top-level array carrying more messages than this endpoint accepts (`tenant_mcp.batch_too_large`); or the `Idempotency-Key` header is malformed (`tenant_api.idempotency_key_invalid`), disagrees with the body''s `idempotency_key` (`tenant_api.idempotency_key_conflict`), or was sent to an action that cannot replay a retry (`tenant_api.idempotency_unsupported`). Nothing ran.'
headers:
x-goosy-api:
description: Present while this API is in beta; the value is `beta`.
schema:
type: string
const: beta
x-request-id:
description: 'This request''s id: the `x-request-id` you sent when it was well formed, otherwise one generated for you. Quote it to support; it is recorded on every audit row the call wrote.'
schema:
type: string
Deprecation:
description: 'RFC 9745: this refusal''s nested `error` object is deprecated, since this instant (`@<unix seconds>`).'
schema:
type: string
Sunset:
description: 'RFC 8594: the nested `error` object may be removed after this date (2026-12-31).'
schema:
type: string
Link:
description: The page that says what to read instead (`rel="deprecation"`).
schema:
type: string
RateLimit-Limit:
description: Requests this key may make in a rolling minute.
schema:
type: integer
minimum: 1
RateLimit-Remaining:
description: Requests left in the current rolling minute.
schema:
type: integer
minimum: 0
RateLimit-Reset:
description: Whole seconds until the window frees more requests.
schema:
type: integer
minimum: 1
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'401':
description: No bearer credential, or one that did not resolve. Deliberately ONE undifferentiated answer for absent / unknown / revoked / expired, so the endpoint is never an oracle over the key space.
headers:
x-goosy-api:
description: Present while this API is in beta; the value is `beta`.
schema:
type: string
const: beta
x-request-id:
description: 'This request''s id: the `x-request-id` you sent when it was well formed, otherwise one generated for you. Quote it to support; it is recorded on every audit row the call wrote.'
schema:
type: string
Deprecation:
description: 'RFC 9745: this refusal''s nested `error` object is deprecated, since this instant (`@<unix seconds>`).'
schema:
type: string
Sunset:
description: 'RFC 8594: the nested `error` object may be removed after this date (2026-12-31).'
schema:
type: string
Link:
description: The page that says what to read instead (`rel="deprecation"`).
schema:
type: string
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'403':
description: The credential is good but the surface is not open to it — the platform or account API switch is off, or the holder lacks the `api.access` capability. The `code` says which.
headers:
x-goosy-api:
description: Present while this API is in beta; the value is `beta`.
schema:
type: string
const: beta
x-request-id:
description: 'This request''s id: the `x-request-id` you sent when it was well formed, otherwise one generated for you. Quote it to support; it is recorded on every audit row the call wrote.'
schema:
type: string
Deprecation:
description: 'RFC 9745: this refusal''s nested `error` object is deprecated, since this instant (`@<unix seconds>`).'
schema:
type: string
Sunset:
description: 'RFC 8594: the nested `error` object may be removed after this date (2026-12-31).'
schema:
type: string
Link:
description: The page that says what to read instead (`rel="deprecation"`).
schema:
type: string
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'404':
description: No such tool. The body names no tool and is identical for every unrecognised name.
headers:
x-goosy-api:
description: Present while this API is in beta; the value is `beta`.
schema:
type: string
const: beta
x-request-id:
description: 'This request''s id: the `x-request-id` you sent when it was well formed, otherwise one generated for you. Quote it to support; it is recorded on every audit row the call wrote.'
schema:
type: string
Deprecation:
description: 'RFC 9745: this refusal''s nested `error` object is deprecated, since this instant (`@<unix seconds>`).'
schema:
type: string
Sunset:
description: 'RFC 8594: the nested `error` object may be removed after this date (2026-12-31).'
schema:
type: string
Link:
description: The page that says what to read instead (`rel="deprecation"`).
schema:
type: string
RateLimit-Limit:
description: Requests this key may make in a rolling minute.
schema:
type: integer
minimum: 1
RateLimit-Remaining:
description: Requests left in the current rolling minute.
schema:
type: integer
minimum: 0
RateLimit-Reset:
description: Whole seconds until the window frees more requests.
schema:
type: integer
minimum: 1
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'429':
description: Over this key's per-minute cap. Carries `Retry-After` and `error.retry_after_seconds`.
headers:
x-goosy-api:
description: Present while this API is in beta; the value is `beta`.
schema:
type: string
const: beta
x-request-id:
description: 'This request''s id: the `x-request-id` you sent when it was well formed, otherwise one generated for you. Quote it to support; it is recorded on every audit row the call wrote.'
schema:
type: string
Deprecation:
description: 'RFC 9745: this refusal''s nested `error` object is deprecated, since this instant (`@<unix seconds>`).'
schema:
type: string
Sunset:
description: 'RFC 8594: the nested `error` object may be removed after this date (2026-12-31).'
schema:
type: string
Link:
description: The page that says what to read instead (`rel="deprecation"`).
schema:
type: string
RateLimit-Limit:
description: Requests this key may make in a rolling minute.
schema:
type: integer
minimum: 1
RateLimit-Remaining:
description: Requests left in the current rolling minute.
schema:
type: integer
minimum: 0
RateLimit-Reset:
description: Whole seconds until the window frees more requests.
schema:
type: integer
minimum: 1
Retry-After:
description: Whole seconds to wait before retrying.
schema:
type: integer
minimum: 1
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
servers:
- url: https://app.goosybear.ai
description: Production
components:
schemas:
Error:
type: object
properties:
ok:
type: boolean
const: false
code:
type: string
description: The typed refusal code — e.g. `tenant_mcp.rate_limited`, `tenant_api.unknown_tool`.
message:
type: string
description: A sentence a person can act on.
retry_after_seconds:
description: 'On a 429: whole seconds to wait. Mirrors `Retry-After`.'
type: number
error:
type: object
properties:
code:
type: string
message:
type: string
retry_after_seconds:
type: number
required:
- code
- message
description: 'Deprecated: the same values as the top-level fields, kept until 2026-12-31. Read `code` and `message` at the top level.'
additionalProperties: false
required:
- ok
- code
- message
- error
description: A request the boundary refused before dispatching anything. The same shape the MCP endpoint answers its own refusals with, and the same top-level fields a dispatched call's refusal carries, so one client branch covers both.
additionalProperties: false
ToolRefusal:
type: object
properties:
ok:
type: boolean
const: false
code:
type: string
description: The typed reason — e.g. `workspace_ambiguous`, `invalid_arguments`, or the tool's own failure code.
message:
type: string
description: A sentence a person can act on.
workspaces:
description: 'On a workspace refusal: the slugs this key may pass as `workspace`.'
type: array
items:
type: string
issues:
description: 'On `invalid_arguments`: which fields failed, and why.'
type: array
items:
type: object
properties:
path:
type: string
message:
type: string
required:
- path
- message
additionalProperties: false
path:
description: 'On an authoring refusal: where in your call''s input it points, e.g. `steps.<key>.params.<field>`.'
type: string
fix:
description: 'On an authoring refusal: the change to your call that would pass.'
type: string
instruction:
description: 'On an authoring refusal: what to do next with it.'
type: string
required:
- ok
- code
- message
description: A call that was admitted and dispatched, and did not succeed.
additionalProperties: false
securitySchemes:
tenantApiKey:
type: http
scheme: bearer
description: 'An API key minted at Settings › API & MCP. Send it as `Authorization: Bearer <key>`. A key carries its holder''s own permissions, resolved on every call — revoking a membership closes the key''s reach immediately. Keep it in an environment variable (`GOOSY_API_KEY`), never in a committed file.'
x-refined-from:
- goosybear-ai-openapi.json
- goosybear-ai-openapi.yml