HERE

HERE API Key Management API

API Key Management APIs enable identities authorized to manage an application to create and maintain API keys. API Keys can be used to simplify the usage of HLS services by insecure clients.

Documentation GitHub OpenAPI

Business capability

Developer Identity & Credential Management BC-4270.40

Operations 7

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

POST /apps/{app}/apiKeys Generate a new API key for an app · Generate API Key #

Ask an LLM

“How do I create an API key to authenticate my app?”

“Can a new API key be set to expire automatically?”

Tell an agent

Generate an API key named {name} for app {app}.

Create API key {name} on app {app} that expires at {expiresAt}.

GET /apps/{app}/apiKeys List an app's API keys · Get API Keys #

Ask an LLM

“Which API keys have been generated for my HERE app?”

“Can I page through all the keys on one application?”

Tell an agent

List the API keys for app {app}.

Show every API key generated for application {app}.

DELETE /apps/{app}/apiKeys/{apiKey} Delete an app's API key permanently · Delete API Key #

Ask an LLM

“How do I permanently delete a leaked API key?”

“Can a deleted API key ever be recovered?”

Tell an agent destructive · confirm first

Delete API key {apiKey} from app {app}.

Permanently remove key {apiKey} on application {app}.

GET /apps/{app}/apiKeys/{apiKey} Get one API key of an app · Retrieve API Key by user #

Ask an LLM

“What are the details of a specific API key on my app?”

“Is a given API key still enabled and when does it expire?”

Tell an agent

Get API key {apiKey} for app {app}.

Show the status and expiry of key {apiKey} on app {app}.

PATCH /apps/{app}/apiKeys/{apiKey} Rename an API key or change its expiry · Update API Key #

Ask an LLM

“Can I rename an existing API key?”

“How do I extend the expiration date of an API key?”

Tell an agent

Rename API key {apiKey} on app {app} to {name}.

Change the expiry of key {apiKey} on app {app} to {expiresAt}.

POST /apps/{app}/apiKeys/{apiKey}/enable Enable a disabled API key · Enable API Key #

Ask an LLM

“How do I turn a disabled API key back on?”

“Can I reactivate a key instead of generating a new one?”

Tell an agent

Enable API key {apiKey} on app {app}.

Reactivate key {apiKey} for application {app}.

POST /apps/{app}/apiKeys/{apiKey}/disable Disable an API key without deleting it · Disable API Key #

Ask an LLM

“Can I temporarily block an API key without deleting it?”

“What is the reversible way to stop a key from authenticating?”

Tell an agent

Disable API key {apiKey} on app {app}.

Suspend key {apiKey} for application {app} so it stops working for now.

Documentation

https://docs.here.com/identity-and-access-management/docs

https://docs.here.com/identity-and-access-management/reference

https://docs.here.com/data-api/docs

https://docs.here.com/data-api/reference

https://docs.here.com/usage/docs

https://docs.here.com/usage/reference

https://docs.here.com/destination-weather/docs

https://docs.here.com/destination-weather/reference

https://docs.here.com/ev-products/docs

https://docs.here.com/ev-products/reference

https://docs.here.com/fuel-prices/docs

https://docs.here.com/fuel-prices/reference

https://docs.here.com/geocoding-and-search/docs

https://docs.here.com/geocoding-and-search/reference

https://docs.here.com/routing/docs

https://docs.here.com/routing/reference

https://docs.here.com/positioning/docs

https://docs.here.com/positioning/reference

https://docs.here.com/indoor-map/docs

https://docs.here.com/indoor-map/reference

https://docs.here.com/transit/docs

https://docs.here.com/transit/reference

https://docs.here.com/map-attributes/docs

https://docs.here.com/map-attributes/reference

https://docs.here.com/map-rendering/docs

https://docs.here.com/map-rendering/reference

https://docs.here.com/workspace/docs

https://docs.here.com/workspace/reference

https://docs.here.com/tour-planning/docs

https://docs.here.com/tour-planning/reference

https://docs.here.com/tracking/docs

https://docs.here.com/tracking/reference

https://docs.here.com/traffic-api/docs

https://docs.here.com/traffic-api/reference

https://docs.here.com/wego-pro/docs

https://docs.here.com/wego-pro/reference

Specifications

https://raw.githubusercontent.com/api-evangelist/here/refs/heads/main/openapi/here-api-key-management-api-openapi.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this

find_apisBrowse and filter every API in the catalog.
get_api_artifactsOne API's artifacts, grouped by type.
get_openapiThe primary OpenAPI for this API.
find_similar_apisAPIs that look like this one.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This API

curl "https://apis.io/api/v1/apis/here:here-api-key-management-api"

All apis

curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

openapi: 3.2.0
info:
  title: Authentication API v1.1 API Key Management API
  version: 1.1.x
  description: 'This specification describes the Authentication v1.1 APIs.

    NOTE: Swagger UI automatically URL encodes parameters when required.

    If/when the APIs are called elsewhere make sure to URL encode the parameters when required.'
servers:
- url: Use API Lookup for a base URL
tags:
- name: API Key Management
  description: API Key Management APIs enable identities authorized to manage an application to create and maintain API keys. API Keys can be used to simplify the usage of HLS services by insecure clients.
paths:
  /apps/{app}/apiKeys:
    parameters:
    - $ref: '#/components/parameters/App'
    - $ref: '#/components/parameters/XCorrelationId'
    - $ref: '#/components/parameters/XRequestId'
    post:
      tags:
      - API Key Management
      summary: Generate API Key
      operationId: generateAPIKey
      description: 'This generates a new API key that you use for authenticating an application. Note that the API key is contained in the field named `apiKeyId`.

        The value in the field `apiKey` is the HERE Resource Name (HRN) prefixed with “hrn" followed by the API key, and is not usable as an API key in the request.

        A maximum of two API keys can be maintained per application.


        Access Control:

        * The calling principal must have **"manage"** or **"write"** action permission for the resource **"{app}"** in the **"account"** service.

        * The calling principal MUST NOT include a project scope.'
      security:
      - UserOrClientBearerToken: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/APIKeyGenerateRequest'
      responses:
        '201':
          description: Created
          headers:
            X-Correlation-ID:
              $ref: '#/components/headers/XCorrelationId'
            X-Request-ID:
              $ref: '#/components/headers/XRequestId'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiKey'
        '400':
          description: '* 400337 - API Key cannot be generated for client with issuer(s).

            '
        '401':
          description: '* 401300 - Access is denied due to invalid credentials.

            '
        '404':
          description: '* 404660 - No app exists with the given id.

            '
        '409':
          description: '* 409303 - Reached allowed maximum number of active API keys per application. Delete an API key to generate another one.

            '
        '429':
          description: '* 429003 - Request blocked because of too many requests made. Wait for a while before making a new request.

            '
    get:
      parameters:
      - $ref: '#/components/parameters/PageToken'
      - $ref: '#/components/parameters/Limit'
      tags:
      - API Key Management
      summary: Get API Keys
      operationId: getAPIKeys
      description: 'Lists the API keys generated for an application.


        Access Control:

        * The calling principal must have **"read"** action permission for the resource **"{app}"** in the **"account"** service.

        * The calling principal MUST NOT include a project scope.'
      security:
      - UserOrClientBearerToken: []
      responses:
        '200':
          description: OK
          headers:
            X-Correlation-ID:
              $ref: '#/components/headers/XCorrelationId'
            X-Request-ID:
              $ref: '#/components/headers/XRequestId'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiKeyPageWToken'
        '404':
          description: '* 404660 - No app exists with the given id.

            '
        '429':
          description: '* 429003 - Request blocked because of too many requests made. Wait for a while before making a new request.

            '
  /apps/{app}/apiKeys/{apiKey}:
    parameters:
    - $ref: '#/components/parameters/App'
    - $ref: '#/components/parameters/ApiKey'
    - $ref: '#/components/parameters/XCorrelationId'
    - $ref: '#/components/parameters/XRequestId'
    delete:
      tags:
      - API Key Management
      summary: Delete API Key
      operationId: deleteAPIKey
      description: 'Deletes API key of the application. This API key can no longer be used for authentication or authorization.


        Since API key cannot be recovered once deleted, it is recommended that the client application calling this

        end-point should enforce a confirmation of delete action (Example: Confirm box saying: Are you sure you want to delete this API Key?).


        Access Control:

        * The calling principal must have **"manage"** or **"write"** action permission for the resource **"{app}"** in the **"account"** service.

        * The calling principal MUST NOT include a project scope.'
      security:
      - UserOrClientBearerToken: []
      responses:
        '204':
          description: No Content
          headers:
            X-Correlation-ID:
              $ref: '#/components/headers/XCorrelationId'
            X-Request-ID:
              $ref: '#/components/headers/XRequestId'
        '401':
          description: '* 401300 - Access is denied due to invalid credentials.

            '
        '404':
          description: '* 404660 - No app exists with the given id.

            * 404666 - The API key does not exist.

            '
        '429':
          description: '* 429003 - Request blocked because of too many requests made. Wait for a while before making a new request.

            '
    get:
      tags:
      - API Key Management
      summary: Retrieve API Key by user
      operationId: getAPIKeyByUser
      description: 'Retrieves API key of the application.


        Access Control:

        * The calling principal must have **"read"** action permission for the resource **"{app}"** in the **"account"** service.

        * The calling principal MUST NOT include a project scope.'
      security:
      - UserOrClientBearerToken: []
      responses:
        '200':
          description: OK
          headers:
            X-Correlation-ID:
              $ref: '#/components/headers/XCorrelationId'
            X-Request-ID:
              $ref: '#/components/headers/XRequestId'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiKey'
        '401':
          description: '* 401300 - Access is denied due to invalid credentials.

            '
        '404':
          description: '* 404660 - No app exists with the given id.

            * 404666 - The API key does not exist

            '
        '429':
          description: '* 429003 - Request blocked because of too many requests made. Wait for a while before making a new request.

            '
    patch:
      tags:
      - API Key Management
      summary: Update API Key
      operationId: updateAPIKey
      description: 'Updates API key of the application.


        Access Control:

        * The calling principal must have **"manage"** or **"write"** action permission for the resource **"{app}"** in the **"account"** service.

        * The calling principal MUST NOT include a project scope.'
      security:
      - UserOrClientBearerToken: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/APIKeyUpdateRequest'
      responses:
        '200':
          description: OK
          headers:
            X-Correlation-ID:
              $ref: '#/components/headers/XCorrelationId'
            X-Request-ID:
              $ref: '#/components/headers/XRequestId'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiKey'
        '401':
          description: '* 401300 - Access is denied due to invalid credentials.

            '
        '404':
          description: '* 404660 - No app exists with the given id.

            * 404666 - The API key does not exist.

            '
        '429':
          description: '* 429003 - Request blocked because of too many requests made. Wait for a while before making a new request.

            '
  /apps/{app}/apiKeys/{apiKey}/enable:
    parameters:
    - $ref: '#/components/parameters/App'
    - $ref: '#/components/parameters/ApiKey'
    - $ref: '#/components/parameters/XCorrelationId'
    - $ref: '#/components/parameters/XRequestId'
    post:
      security:
      - UserOrClientBearerToken: []
      tags:
      - API Key Management
      summary: Enable API Key
      description: 'Enables API key of the application.


        Access Control:

        * The calling principal must have **"manage"** or **"write"** action permission for the resource **"{app}"** in the **"account"** service.

        * The calling principal MUST NOT include a project scope.'
      operationId: enableAPIKey
      responses:
        '204':
          description: No Content
          headers:
            X-Correlation-ID:
              $ref: '#/components/headers/XCorrelationId'
            X-Request-ID:
              $ref: '#/components/headers/XRequestId'
        '401':
          description: '* 401300 - Access is denied due to invalid credentials.

            '
        '404':
          description: '* 404660 - No app exists with the given id.

            * 404666 - The API key does not exist.

            '
        '429':
          description: '* 429003 - Request blocked because of too many requests made. Wait for a while before making a new request.

            '
  /apps/{app}/apiKeys/{apiKey}/disable:
    parameters:
    - $ref: '#/components/parameters/App'
    - $ref: '#/components/parameters/ApiKey'
    - $ref: '#/components/parameters/XCorrelationId'
    - $ref: '#/components/parameters/XRequestId'
    post:
      security:
      - UserOrClientBearerToken: []
      tags:
      - API Key Management
      summary: Disable API Key
      description: 'Disables API key of the application.


        Access Control:

        * The calling principal must have **"manage"** or **"write"** action permission for the resource **"{app}"** in the **"account"** service.

        * The calling principal MUST NOT include a project scope.'
      operationId: disableAPIKey
      responses:
        '204':
          description: No Content
          headers:
            X-Correlation-ID:
              $ref: '#/components/headers/XCorrelationId'
            X-Request-ID:
              $ref: '#/components/headers/XRequestId'
        '401':
          description: '* 401300 - Access is denied due to invalid credentials.

            '
        '404':
          description: '* 404660 - No app exists with the given id.

            * 404666 - The API key does not exist.

            '
        '429':
          description: '* 429003 - Request blocked because of too many requests made. Wait for a while before making a new request.

            '
components:
  headers:
    XRequestId:
      schema:
        type: string
      required: false
      description: The unique id for the request, used to track this request within the service. X-Request-ID value is NOT propagated to the downstream services.
    XCorrelationId:
      schema:
        type: string
      required: false
      description: The X-Correlation-ID for the request, used to track this request in the platform. X-Correlation-ID value is propagated throughout the platform.
  parameters:
    XCorrelationId:
      in: header
      name: X-Correlation-ID
      schema:
        type: string
      required: false
      description: 'Correlates HTTP requests between a client and server. If not present in the incoming request, it will be generated. This header and value will be included in all loglines including access logs. It will also be propagated to downstream services and returned in the response.

        '
    XRequestId:
      in: header
      name: X-Request-ID
      schema:
        type: string
      required: false
      description: 'The unique for the request, used to track this request within the service. X-Request-ID value is NOT propagated to the downstream services.

        '
    Limit:
      in: query
      name: limit
      required: false
      description: Number of records to return. Default is 100 records. Maximum is 100 records.
      schema:
        type: integer
        minimum: 0
        maximum: 100
        default: 100
    App:
      in: path
      required: true
      name: app
      schema:
        type: string
      description: 'HRN identifying the application. Must be URL-encoded, if reserved characters ":/?#[]@!$&''()*+,;=" are used. see https://tools.ietf.org/html/rfc3986#section-2.2.

        '
    ApiKey:
      in: path
      required: true
      name: apiKey
      schema:
        type: string
      description: 'HRN with obfuscated apiKeyId. Must be URL-encoded, if reserved characters ":/?#[]@!$&''()*+,;=" are used. see https://tools.ietf.org/html/rfc3986#section-2.2.

        '
      example: hrn:here:account::myrealm:apikey/ygfDVbZc7vJQTRGjC5-YXZbuwWwxFu4FxD5SsWbp-no
    PageToken:
      name: pageToken
      in: query
      required: false
      description: 'If there are more records than ''limit'' (between 1 and 100), and there are multiple pages of records, ''pageToken'' allows for retrieval of individual pages. In order to retrieve subsequent pages, the client should provide the pageToken returned in the result from the previous API call as input to the following API call.


        Example: If the result for a call to GET /items returns *{..., "pageToken": "abcdefg"}*, in order  to retrieve the next page of ''items'' the client should call GET /items?pageToken=abcdefg

        '
      schema:
        type: string
  schemas:
    PageWithToken:
      type: object
      required:
      - limit
      - total
      - items
      properties:
        limit:
          type: integer
          example: 1
          description: number of entries in the response.
        pageToken:
          type: string
          example: KuMvTQrdHVVKuMDDdcIvTQrdci1FWdcIHVVci1FW
          description: The cursor for pagination. Present only if there is an additional page of data to view.
        total:
          type: integer
          example: 1
          description: The number of federations matching the search criteria.
    APIKeyGenerateRequest:
      type: object
      required:
      - name
      properties:
        name:
          $ref: '#/components/schemas/APIKeyName'
        expiresAt:
          $ref: '#/components/schemas/APIKeyExpiresAt'
        enabled:
          $ref: '#/components/schemas/APIKeyEnabled'
    ApiKey:
      type: object
      properties:
        apiKeyId:
          type: string
          description: 'Plaintext query string argument used to authenticate requests to HERE Services using this API Key.

            '
          example: 2MZr9AInTFk45NAU8ClIza2Yw7w_AXyUyM4ChvtO7bY
        apiKey:
          type: string
          description: 'HRN with obfuscated apiKeyId.

            '
          example: hrn:here:account::myrealm:apikey/ygfDVbZc7vJQTRGjC5-YXZbuwWwxFu4FxD5SsWbp-no
        identity:
          type: string
          description: 'HRN identifying an identity to which this API key associated with.

            '
          example: hrn:here:account::myrealm:app/lACE8kgYxsahjbXnvy8w
        realm:
          type: string
          description: 'The HRN of the realm of API key.

            '
          example: hrn:here:account::myrealm:realm/myrealm
        name:
          $ref: '#/components/schemas/APIKeyName'
        enabled:
          $ref: '#/components/schemas/APIKeyEnabled'
        createdTime:
          type: integer
          format: int64
          description: 'Timestamp (milliseconds since the Unix epoch) of when the API key was created.

            '
          example: 1545041748000
        expiresAt:
          $ref: '#/components/schemas/APIKeyExpiresAt'
    APIKeyEnabled:
      type: boolean
      description: 'Whether API key is enabled or disabled.

        '
      default: true
      example: true
    APIKeyExpiresAt:
      type: integer
      format: int64
      description: 'Timestamp (milliseconds since the Unix epoch) of when the API key will expire.

        If expiresAt is not provided on creation, it will default to ''-1'', i.e. API key does NOT expire

        '
      default: -1
      example: 1545041748000
    APIKeyUpdateRequest:
      type: object
      properties:
        name:
          $ref: '#/components/schemas/APIKeyName'
        expiresAt:
          $ref: '#/components/schemas/APIKeyExpiresAt'
    ApiKeyPageWToken:
      allOf:
      - $ref: '#/components/schemas/PageWithToken'
      - type: object
        properties:
          items:
            type: array
            items:
              $ref: '#/components/schemas/ApiKey'
        example:
          total: 2
          pageToken: 7afd7f8e94eb4844ba45
          limit: 1
          items:
          - apiKeyId: 2MZr9AInTFk45NAU8ClIza2Yw7w_AXyUyM4ChvtO7bY
            apiKey: hrn:here:account::myrealm:apikey/ygfDVbZc7vJQTRGjC5-YXZbuwWwxFu4FxD5SsWbp-no
            identity: hrn:here:account::myrealm:app/lACE8kgYxsahjbXnvy8w
            realm: hrn:here:account::myrealm:realm/myrealm
            name: First API key for ABC app
            enabled: true
            createdTime: 1545041748000
            expiresAt: 1545041748456
    APIKeyName:
      type: string
      description: 'Creator-defined name or short description for the API key.

        '
      example: API Key for test app
  securitySchemes:
    UserOrClientBearerToken:
      type: http
      scheme: bearer
      description: Bearer Token issued to either User or Client.
    Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: 'A HERE access token obtained from one of the supported OAuth 2.0 authorization flows.

        For more information on how to get a bearer token, see the

        [https://www.here.com/docs/bundle/identity-and-access-management-developer-guide/page/README.html](Identity & Access Management Guide).

        '
externalDocs:
  description: The developer guide and related API references are available here.
  url: https://www.here.com/docs/category/identity-and-access-management