kaiv-ai Keys API

openapi: 3.2.0
info:
  title: Kaiva Bridge Management Keys API
  version: 1.0.0
  summary: Create, read and publish managed MCP servers from an OpenAPI spec, a GraphQL API, a database, documents or a remote MCP server.
  description: 'The REST API behind the Kaiva Bridge console and the @kaiva/bridge CLI. It creates managed MCP servers from an OpenAPI or Swagger spec, a GraphQL endpoint, a PostgreSQL, MySQL, MariaDB or SQL Server database, uploaded documents or a remote MCP server, chooses which tools are exposed, publishes the server and creates the keys AI clients use.


    Every request carries a management key: `Authorization: Bearer kv_mgmt_...`. An owner or admin creates one in the console under Keys & access (type Management), or `npx @kaiva/bridge login` approves a machine and saves one. A management key acts on its own workspace only, and it cannot create another management key. Gateway keys (`kv_live_...`) are for calling an MCP server and are refused here.


    A published server is an MCP endpoint (Streamable HTTP) at `https://api.kaiv.ai/api/bridge/mcp/`. AI clients call it with MCP, not with this API. Claude, ChatGPT, Cursor, VS Code and Claude Code can sign in to it with OAuth 2.1 instead of a key.


    Limits: 120 requests a minute per address; 60 document uploads a minute and 12 credential tests a minute per workspace.


    The CLI''s source is public: https://github.com/ai-kaiva/bridge'
  contact:
    name: Kaiva support
    email: support@kaiv.ai
    url: https://kaiv.ai/bridge/docs
  termsOfService: https://kaiv.ai/terms
servers:
- url: https://api.kaiv.ai/api/bridge/v1
  description: Production
security:
- managementKey: []
tags:
- name: Keys
  description: Gateway keys for AI clients that use a key instead of signing in.
paths:
  /keys:
    get:
      tags:
      - Keys
      operationId: listKeys
      summary: List the workspace's keys
      responses:
        '200':
          description: Keys, without their secret (only a prefix is kept for display).
          content:
            application/json:
              schema:
                type: object
                properties:
                  keys:
                    type: array
                    items:
                      type: object
                      additionalProperties: true
        '401':
          $ref: '#/components/responses/Unauthorized'
    post:
      tags:
      - Keys
      operationId: createGatewayKey
      summary: Create a gateway key for an AI client that uses a key
      description: A gateway key calls the MCP servers it names. The key is returned once; Bridge keeps only its hash. This API never creates a management key.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
              - label
              - serverIds
              properties:
                label:
                  type: string
                serverIds:
                  type: array
                  items:
                    type: string
                  description: The servers this key may call.
                policyId:
                  type: string
                  description: A policy that limits which tools the key may call.
      responses:
        '201':
          description: The new key, shown once.
          content:
            application/json:
              schema:
                type: object
                properties:
                  key:
                    type: object
                    properties:
                      key:
                        type: string
                        description: kv_live_..., shown only in this answer.
                    additionalProperties: true
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /keys/{id}:
    parameters:
    - name: id
      in: path
      required: true
      schema:
        type: string
    delete:
      tags:
      - Keys
      operationId: revokeKey
      summary: Revoke a key
      description: Requests with it are refused at once.
      responses:
        '200':
          description: Revoked.
          content:
            application/json:
              schema:
                type: object
                properties:
                  revoked: {}
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
components:
  responses:
    Unauthorized:
      description: No key, an unknown key, or a gateway key (kv_live_) where a management key is needed.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    BadRequest:
      description: The request is missing something or has a value Bridge cannot use; the answer says which.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    NotFound:
      description: No such item in this workspace.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
  schemas:
    Error:
      type: object
      properties:
        error:
          type: string
          description: A short code, or a sentence for errors in your request.
        message:
          type: string
  securitySchemes:
    managementKey:
      type: http
      scheme: bearer
      bearerFormat: kv_mgmt_
      description: A management key (kv_mgmt_...). Create one in the console under Keys & access, or run `npx @kaiva/bridge login`.
externalDocs:
  description: Kaiva Bridge docs
  url: https://kaiv.ai/bridge/docs