infinihash-com API Keys API

openapi: 3.2.0
info:
  title: Infinihash KYC API Keys API
  version: 1.0.0
  description: 'Identity verification, KYB, sanctions screening, UBO orchestration and periodic review.


    Auth: send your key as `X-API-Key: ` (or `Authorization: Bearer `).


    Most endpoints are mounted twice — at the root (`/kyc/...`) and under `/api` (`/api/kyc/...`). Prefer the `/api` form; it is what the hosted portals and SDKs use.


    Python SDK: `pip install "git+https://github.com/Infinihash/kyc-python@v0.1.0"` (https://github.com/Infinihash/kyc-python; runnable examples in examples/).'
  contact:
    name: Infinihash
    url: https://kyc.infinihash.com
servers:
- url: https://kyc-api.infinihash.com
  description: Production
tags:
- name: API Keys
paths:
  /keys:
    get:
      x-route-source:
        file: routes/keys.js
        method: get
        path: /
      summary: List API keys
      description: Lists the non-revoked API keys owned by the caller's tenant (same owner id), newest first.
      tags:
      - API Keys
      operationId: listKeys
      security:
      - ApiKeyAuth: []
      - BearerAuth: []
      responses:
        '200':
          description: API keys
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/ApiKeySummary'
        '401':
          description: Missing API key, or invalid or revoked API key
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '429':
          description: Rate limited
        '500':
          description: Unexpected server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    post:
      x-route-source:
        file: routes/keys.js
        method: post
        path: /
      summary: Mint a tenant API key (admin)
      description: 'Creates a new API key owned by the caller''s tenant and returns the raw key exactly once. Requires BOTH an API key (to identify the tenant) and the X-Admin-Secret header. Tier ''sandbox'' is rejected; sandbox keys come only from POST /sandbox/keys. Admin-only: requires the X-Admin-Secret header (not an API key).'
      tags:
      - API Keys
      operationId: createKey
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
              - name
              properties:
                name:
                  type: string
                tier:
                  type: string
                  default: starter
                  description: Key tier; 'sandbox' is refused.
      security:
      - ApiKeyAuth: []
      - BearerAuth: []
      responses:
        '200':
          description: Key created (raw key shown once)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiKeyCreated'
        '400':
          description: name is required, or sandbox tier requested
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Missing API key, or invalid or revoked API key
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: Missing or wrong X-Admin-Secret header
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '429':
          description: Rate limited
        '500':
          description: Unexpected server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /keys/{id}:
    delete:
      x-route-source:
        file: routes/keys.js
        method: delete
        path: /:id
      summary: Revoke an API key
      description: Revokes an API key owned by the caller's tenant. The path `id` is an API key id (not a submission id). Returns 404 for keys outside the tenant to avoid id enumeration.
      tags:
      - API Keys
      operationId: revokeKey
      parameters:
      - name: id
        in: path
        required: true
        schema:
          type: string
        description: KYC submission id
      security:
      - ApiKeyAuth: []
      - BearerAuth: []
      responses:
        '200':
          description: Key revoked
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiKeyRevoked'
        '401':
          description: Missing API key, or invalid or revoked API key
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '429':
          description: Rate limited
        '500':
          description: Unexpected server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
components:
  schemas:
    ApiKeyRevoked:
      type: object
      required:
      - revoked
      properties:
        revoked:
          type: boolean
          enum:
          - true
        id:
          type: string
          description: Id of the revoked key (returned by DELETE /keys/{id} only).
    ApiKeyCreated:
      type: object
      required:
      - id
      - name
      - tier
      - key
      - prefix
      - createdAt
      - note
      properties:
        id:
          type: string
        name:
          type: string
        tier:
          type: string
        key:
          type: string
          description: The raw API key (prefix kyc_). Returned only once.
        prefix:
          type: string
          description: First 12 characters of the key, for identification.
        createdAt:
          type: string
          format: date-time
        note:
          type: string
    ApiKeySummary:
      type: object
      required:
      - id
      - name
      - tier
      - keyPrefix
      - createdAt
      - lastUsedAt
      properties:
        id:
          type: string
        name:
          type: string
        tier:
          type: string
        keyPrefix:
          type: string
        createdAt:
          type: string
          format: date-time
        lastUsedAt:
          type:
          - string
          - 'null'
          format: date-time
    Error:
      type: object
      required:
      - error
      properties:
        error:
          type: string
  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      in: header
      name: X-API-Key
    BearerAuth:
      type: http
      scheme: bearer