MongoDB

MongoDB Programmatic API Keys API

Returns, adds, edits, and removes access tokens to use the MongoDB Cloud API. MongoDB Cloud applies these keys to organizations. These resources can return, assign, or revoke use of these keys within a specified project.

GitHub OpenAPI

Documentation

📖
Documentation
https://www.mongodb.com/docs/atlas/api/atlas-admin-api-ref/
📖
Authentication
https://www.mongodb.com/docs/atlas/api/api-authentication/
📖
RateLimits
https://www.mongodb.com/docs/atlas/api/api-rate-limit/

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/mongodb/refs/heads/main/openapi/mongodb-programmatic-api-keys-api-openapi.yml

Other Resources

🔗
Versioning
https://www.mongodb.com/docs/atlas/api/versioned-api-overview/
🔗
ChangeLog
https://www.mongodb.com/docs/atlas/reference/api-resources-spec/changelog/
🔗
GraphQL
https://raw.githubusercontent.com/api-evangelist/mongodb/refs/heads/main/graphql/mongodb-graphql.md

OpenAPI Specification

mongodb-programmatic-api-keys-api-openapi.yml Raw ↑ 
openapi: 3.0.1
info:
  description: "The MongoDB Atlas Administration API allows developers to manage all components in MongoDB Atlas.\n\nThe Atlas Administration API supports OAuth2 Service Accounts and HTTP Digest-based API keys. Service accounts are the recommended authentication method and API keys are considered a legacy option.\n\nTo authenticate with a Service Account, first exchange its client ID and secret for an access token using the OAuth 2.0 Client Credentials flow. Atlas provides a token endpoint at `POST https://cloud.mongodb.com/api/oauth/token`, which returns a Bearer token that is reusable and valid for 1 hour (3600 seconds).\n\nFor example, to [return a list of your organizations](https://www.mongodb.com/docs/api/doc/atlas-admin-api-v2/operation/operation-listorgs) with [cURL](https://en.wikipedia.org/wiki/CURL), first generate an access token and then use that token to call the same Atlas Administration API endpoint shown in the current example:\n\n```\nACCESS_TOKEN=$(curl -fsS --request POST https://cloud.mongodb.com/api/oauth/token \\\n  --header \"Authorization: Basic $(printf '%s' \"${CLIENT_ID}:${CLIENT_SECRET}\" | base64 | tr -d '\\n')\" \\\n  --header \"Content-Type: application/x-www-form-urlencoded\" \\\n  --header \"Accept: application/json\" \\\n  --data \"grant_type=client_credentials\" | jq -r '.access_token')\n\ncurl --header \"Authorization: Bearer ${ACCESS_TOKEN}\" \\\n  --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n  -X GET \"https://cloud.mongodb.com/api/atlas/v2/orgs?pretty=true\"\n```\n\nIf your organization requires an IP access list for the Atlas Administration API, the token can be created from any IP address, but the API call that uses the token must originate from an allowed IP.\n\nTo learn more, see [Get Started with the Atlas Administration API](https://www.mongodb.com/docs/atlas/configure-api-access/). For support, see [MongoDB Support](https://www.mongodb.com/support/get-started).\n\nYou can also explore the various endpoints available through the Atlas Administration API in MongoDB's [Postman workspace](https://www.postman.com/mongodb-devrel/workspace/mongodb-atlas-administration-apis/) (requires a Postman account)."
  license:
    name: CC BY-NC-SA 3.0 US
    url: https://creativecommons.org/licenses/by-nc-sa/3.0/us/
  termsOfService: https://www.mongodb.com/mongodb-management-service-terms-and-conditions
  title: MongoDB Atlas Administration Access Tracking Programmatic API Keys API
  version: '2.0'
  x-xgen-sha: 3d70e065843c008b9871ea7836c98c9de6f202f9
servers:
- url: https://cloud.mongodb.com
security:
- ServiceAccounts: []
- DigestAuth: []
tags:
- description: Returns, adds, edits, and removes access tokens to use the MongoDB Cloud API. MongoDB Cloud applies these keys to organizations. These resources can return, assign, or revoke use of these keys within a specified project.
  name: Programmatic API Keys
paths:
  /api/atlas/v2/groups/{groupId}/apiKeys:
    get:
      description: Returns all organization API keys that you assigned to the specified project. Users with the Project Owner role in the project associated with the API key can use the organization API key to access the resources. To use this resource, the requesting Service Account or API Key must have the Project Owner role.
      externalDocs:
        description: Programmatic API Keys
        url: https://docs.atlas.mongodb.com/configure-api-access/#std-label-atlas-prog-api-key
      operationId: listGroupApiKeys
      parameters:
      - $ref: '#/components/parameters/envelope'
      - $ref: '#/components/parameters/groupId'
      - $ref: '#/components/parameters/includeCount'
      - $ref: '#/components/parameters/itemsPerPage'
      - $ref: '#/components/parameters/pageNum'
      - $ref: '#/components/parameters/pretty'
      responses:
        '200':
          content:
            application/vnd.atlas.2023-01-01+json:
              schema:
                $ref: '#/components/schemas/PaginatedApiApiUserView'
              x-xgen-version: '2023-01-01'
          description: OK
          headers:
            RateLimit-Limit:
              $ref: '#/components/headers/HeaderRateLimitLimit'
            RateLimit-Remaining:
              $ref: '#/components/headers/HeaderRateLimitRemaining'
        '401':
          $ref: '#/components/responses/unauthorized'
        '403':
          $ref: '#/components/responses/forbidden'
        '404':
          $ref: '#/components/responses/notFound'
        '429':
          $ref: '#/components/responses/tooManyRequests'
        '500':
          $ref: '#/components/responses/internalServerError'
      summary: Return All Organization API Keys Assigned to One Project
      tags:
      - Programmatic API Keys
      x-codeSamples:
      - lang: cURL
        label: Atlas CLI
        source: atlas api programmaticApiKeys listGroupApiKeys --help
      - lang: go
        label: Go
        source: "import (\n\t\"os\"\n\t\"context\"\n\t\"log\"\n\tsdk \"go.mongodb.org/atlas-sdk/v20250312001/admin\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\tclientID := os.Getenv(\"MONGODB_ATLAS_CLIENT_ID\")\n\tclientSecret := os.Getenv(\"MONGODB_ATLAS_CLIENT_SECRET\")\n\n\t// See https://dochub.mongodb.org/core/atlas-go-sdk-oauth\n\tclient, err := sdk.NewClient(sdk.UseOAuthAuth(clientID, clientSecret))\n\n\tif err != nil {\n\t\tlog.Fatalf(\"Error: %v\", err)\n\t}\n\n\tparams = &sdk.ListGroupApiKeysApiParams{}\n\tsdkResp, httpResp, err := client.ProgrammaticAPIKeysApi.\n\t\tListGroupApiKeysWithParams(ctx, params).\n\t\tExecute()\n}\n"
      - lang: cURL
        label: curl (Service Accounts)
        source: "curl --include --header \"Authorization: Bearer ${ACCESS_TOKEN}\" \\\n  --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n  -X GET \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/apiKeys?pretty=true\""
      - lang: cURL
        label: curl (Digest)
        source: "curl --user \"${PUBLIC_KEY}:${PRIVATE_KEY}\" \\\n  --digest --include \\\n  --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n  -X GET \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/apiKeys?pretty=true\""
      x-rolesRequirements:
      - Project Read Only
      x-xgen-docs-url: https://mongodb.com/docs/atlas/reference/api-resources-spec/v2/#tag/Programmatic-API-Keys/operation/listGroupApiKeys
    post:
      description: Creates and assigns the specified organization API key to the specified project. Users with the Project Owner role in the project associated with the API key can use the organization API key to access the resources. To use this resource, the requesting Service Account or API Key must have the Project Owner role or Project Access Manager role.
      operationId: createGroupApiKey
      parameters:
      - $ref: '#/components/parameters/envelope'
      - $ref: '#/components/parameters/groupId'
      - $ref: '#/components/parameters/pretty'
      requestBody:
        content:
          application/vnd.atlas.2023-01-01+json:
            schema:
              $ref: '#/components/schemas/CreateAtlasProjectApiKey'
        description: Organization API key to be created and assigned to the specified project.
        required: true
      responses:
        '200':
          content:
            application/vnd.atlas.2023-01-01+json:
              schema:
                $ref: '#/components/schemas/ApiKeyUserDetails'
              x-xgen-version: '2023-01-01'
          description: OK
          headers:
            RateLimit-Limit:
              $ref: '#/components/headers/HeaderRateLimitLimit'
            RateLimit-Remaining:
              $ref: '#/components/headers/HeaderRateLimitRemaining'
        '401':
          $ref: '#/components/responses/unauthorized'
        '403':
          $ref: '#/components/responses/forbidden'
        '404':
          $ref: '#/components/responses/notFound'
        '429':
          $ref: '#/components/responses/tooManyRequests'
        '500':
          $ref: '#/components/responses/internalServerError'
      summary: Create and Assign One Organization API Key to One Project
      tags:
      - Programmatic API Keys
      x-codeSamples:
      - lang: cURL
        label: Atlas CLI
        source: atlas api programmaticApiKeys createGroupApiKey --help
      - lang: go
        label: Go
        source: "import (\n\t\"os\"\n\t\"context\"\n\t\"log\"\n\tsdk \"go.mongodb.org/atlas-sdk/v20250312001/admin\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\tclientID := os.Getenv(\"MONGODB_ATLAS_CLIENT_ID\")\n\tclientSecret := os.Getenv(\"MONGODB_ATLAS_CLIENT_SECRET\")\n\n\t// See https://dochub.mongodb.org/core/atlas-go-sdk-oauth\n\tclient, err := sdk.NewClient(sdk.UseOAuthAuth(clientID, clientSecret))\n\n\tif err != nil {\n\t\tlog.Fatalf(\"Error: %v\", err)\n\t}\n\n\tparams = &sdk.CreateGroupApiKeyApiParams{}\n\tsdkResp, httpResp, err := client.ProgrammaticAPIKeysApi.\n\t\tCreateGroupApiKeyWithParams(ctx, params).\n\t\tExecute()\n}\n"
      - lang: cURL
        label: curl (Service Accounts)
        source: "curl --include --header \"Authorization: Bearer ${ACCESS_TOKEN}\" \\\n  --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n  --header \"Content-Type: application/json\" \\\n  -X POST \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/apiKeys\" \\\n  -d '{ <Payload> }'"
      - lang: cURL
        label: curl (Digest)
        source: "curl --user \"${PUBLIC_KEY}:${PRIVATE_KEY}\" \\\n  --digest --include \\\n  --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n  --header \"Content-Type: application/json\" \\\n  -X POST \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/apiKeys\" \\\n  -d '{ <Payload> }'"
      x-rolesRequirements:
      - Project Access Manager
      x-xgen-docs-url: https://mongodb.com/docs/atlas/reference/api-resources-spec/v2/#tag/Programmatic-API-Keys/operation/createGroupApiKey
  /api/atlas/v2/groups/{groupId}/apiKeys/{apiUserId}:
    delete:
      description: Removes one organization API key from the specified project. To use this resource, the requesting Service Account or API Key must have the Project Owner role or Project Access Manager role.
      externalDocs:
        description: Programmatic API Keys
        url: https://docs.atlas.mongodb.com/configure-api-access/#std-label-atlas-prog-api-key
      operationId: removeGroupApiKey
      parameters:
      - $ref: '#/components/parameters/envelope'
      - $ref: '#/components/parameters/groupId'
      - description: Unique 24-hexadecimal digit string that identifies this organization API key that you want to unassign from one project.
        in: path
        name: apiUserId
        required: true
        schema:
          pattern: ^([a-f0-9]{24})$
          type: string
      - $ref: '#/components/parameters/pretty'
      responses:
        '204':
          content:
            application/vnd.atlas.2023-01-01+json:
              x-xgen-version: '2023-01-01'
          description: This endpoint does not return a response body.
          headers:
            RateLimit-Limit:
              $ref: '#/components/headers/HeaderRateLimitLimit'
            RateLimit-Remaining:
              $ref: '#/components/headers/HeaderRateLimitRemaining'
        '400':
          $ref: '#/components/responses/badRequest'
        '401':
          $ref: '#/components/responses/unauthorized'
        '403':
          $ref: '#/components/responses/forbidden'
        '404':
          $ref: '#/components/responses/notFound'
        '429':
          $ref: '#/components/responses/tooManyRequests'
        '500':
          $ref: '#/components/responses/internalServerError'
      summary: Unassign One Organization API Key from One Project
      tags:
      - Programmatic API Keys
      x-codeSamples:
      - lang: cURL
        label: Atlas CLI
        source: atlas api programmaticApiKeys removeGroupApiKey --help
      - lang: go
        label: Go
        source: "import (\n\t\"os\"\n\t\"context\"\n\t\"log\"\n\tsdk \"go.mongodb.org/atlas-sdk/v20250312001/admin\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\tclientID := os.Getenv(\"MONGODB_ATLAS_CLIENT_ID\")\n\tclientSecret := os.Getenv(\"MONGODB_ATLAS_CLIENT_SECRET\")\n\n\t// See https://dochub.mongodb.org/core/atlas-go-sdk-oauth\n\tclient, err := sdk.NewClient(sdk.UseOAuthAuth(clientID, clientSecret))\n\n\tif err != nil {\n\t\tlog.Fatalf(\"Error: %v\", err)\n\t}\n\n\tparams = &sdk.RemoveGroupApiKeyApiParams{}\n\thttpResp, err := client.ProgrammaticAPIKeysApi.\n\t\tRemoveGroupApiKeyWithParams(ctx, params).\n\t\tExecute()\n}\n"
      - lang: cURL
        label: curl (Service Accounts)
        source: "curl --include --header \"Authorization: Bearer ${ACCESS_TOKEN}\" \\\n  --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n  -X DELETE \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/apiKeys/{apiUserId}\""
      - lang: cURL
        label: curl (Digest)
        source: "curl --user \"${PUBLIC_KEY}:${PRIVATE_KEY}\" \\\n  --digest --include \\\n  --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n  -X DELETE \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/apiKeys/{apiUserId}\""
      x-rolesRequirements:
      - Project Access Manager
      x-xgen-docs-url: https://mongodb.com/docs/atlas/reference/api-resources-spec/v2/#tag/Programmatic-API-Keys/operation/removeGroupApiKey
      x-xgen-method-verb-override:
        customMethod: 'True'
        verb: remove
    patch:
      description: Updates the roles of the organization API key that you specify for the project that you specify. You must specify at least one valid role for the project. The application removes any roles that you do not include in this request if they were previously set in the organization API key that you specify for the project. To use this resource, the requesting Service Account or API Key must have the Project Owner role or Project Access Manager role.
      operationId: updateGroupApiKeyRoles
      parameters:
      - $ref: '#/components/parameters/groupId'
      - $ref: '#/components/parameters/pageNum'
      - $ref: '#/components/parameters/itemsPerPage'
      - $ref: '#/components/parameters/includeCount'
      - $ref: '#/components/parameters/pretty'
      - $ref: '#/components/parameters/envelope'
      - description: Unique 24-hexadecimal digit string that identifies this organization API key that you want to unassign from one project.
        in: path
        name: apiUserId
        required: true
        schema:
          pattern: ^([a-f0-9]{24})$
          type: string
      requestBody:
        content:
          application/vnd.atlas.2023-01-01+json:
            schema:
              $ref: '#/components/schemas/UpdateAtlasProjectApiKey'
        description: Organization API Key to be updated. This request requires a minimum of one of the two body parameters.
        required: true
      responses:
        '200':
          content:
            application/vnd.atlas.2023-01-01+json:
              schema:
                $ref: '#/components/schemas/ApiKeyUserDetails'
              x-xgen-version: '2023-01-01'
          description: OK
          headers:
            RateLimit-Limit:
              $ref: '#/components/headers/HeaderRateLimitLimit'
            RateLimit-Remaining:
              $ref: '#/components/headers/HeaderRateLimitRemaining'
        '400':
          $ref: '#/components/responses/badRequest'
        '401':
          $ref: '#/components/responses/unauthorized'
        '403':
          $ref: '#/components/responses/forbidden'
        '404':
          $ref: '#/components/responses/notFound'
        '429':
          $ref: '#/components/responses/tooManyRequests'
        '500':
          $ref: '#/components/responses/internalServerError'
      summary: Update Organization API Key Roles for One Project
      tags:
      - Programmatic API Keys
      x-codeSamples:
      - lang: cURL
        label: Atlas CLI
        source: atlas api programmaticApiKeys updateApiKeyRoles --help
      - lang: go
        label: Go
        source: "import (\n\t\"os\"\n\t\"context\"\n\t\"log\"\n\tsdk \"go.mongodb.org/atlas-sdk/v20250312001/admin\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\tclientID := os.Getenv(\"MONGODB_ATLAS_CLIENT_ID\")\n\tclientSecret := os.Getenv(\"MONGODB_ATLAS_CLIENT_SECRET\")\n\n\t// See https://dochub.mongodb.org/core/atlas-go-sdk-oauth\n\tclient, err := sdk.NewClient(sdk.UseOAuthAuth(clientID, clientSecret))\n\n\tif err != nil {\n\t\tlog.Fatalf(\"Error: %v\", err)\n\t}\n\n\tparams = &sdk.UpdateGroupApiKeyRolesApiParams{}\n\tsdkResp, httpResp, err := client.ProgrammaticAPIKeysApi.\n\t\tUpdateGroupApiKeyRolesWithParams(ctx, params).\n\t\tExecute()\n}\n"
      - lang: cURL
        label: curl (Service Accounts)
        source: "curl --include --header \"Authorization: Bearer ${ACCESS_TOKEN}\" \\\n  --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n  --header \"Content-Type: application/json\" \\\n  -X PATCH \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/apiKeys/{apiUserId}\" \\\n  -d '{ <Payload> }'"
      - lang: cURL
        label: curl (Digest)
        source: "curl --user \"${PUBLIC_KEY}:${PRIVATE_KEY}\" \\\n  --digest --include \\\n  --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n  --header \"Content-Type: application/json\" \\\n  -X PATCH \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/apiKeys/{apiUserId}\" \\\n  -d '{ <Payload> }'"
      x-rolesRequirements:
      - Project Access Manager
      x-xgen-docs-url: https://mongodb.com/docs/atlas/reference/api-resources-spec/v2/#tag/Programmatic-API-Keys/operation/updateGroupApiKeyRoles
      x-xgen-method-verb-override:
        customMethod: 'True'
        verb: updateRoles
      x-xgen-operation-id-override: updateApiKeyRoles
    post:
      description: Assigns the specified organization API key to the specified project. Users with the Project Owner role in the project associated with the API key can then use the organization API key to access the resources. To use this resource, the requesting Service Account or API Key must have the Project Owner role.
      operationId: addGroupApiKey
      parameters:
      - $ref: '#/components/parameters/envelope'
      - $ref: '#/components/parameters/groupId'
      - description: Unique 24-hexadecimal digit string that identifies this organization API key that you want to assign to one project.
        in: path
        name: apiUserId
        required: true
        schema:
          pattern: ^([a-f0-9]{24})$
          type: string
      - $ref: '#/components/parameters/pretty'
      requestBody:
        content:
          application/vnd.atlas.2023-01-01+json:
            schema:
              description: Explanatory text that describes this API key, the list of roles to grant this API key, or both.
              items:
                $ref: '#/components/schemas/UserAccessRoleAssignment'
              type: array
        description: Organization API key to be assigned to the specified project.
        required: true
      responses:
        '204':
          content:
            application/vnd.atlas.2023-01-01+json:
              x-xgen-version: '2023-01-01'
          description: This endpoint does not return a response body.
          headers:
            RateLimit-Limit:
              $ref: '#/components/headers/HeaderRateLimitLimit'
            RateLimit-Remaining:
              $ref: '#/components/headers/HeaderRateLimitRemaining'
        '401':
          $ref: '#/components/responses/unauthorized'
        '403':
          $ref: '#/components/responses/forbidden'
        '404':
          $ref: '#/components/responses/notFound'
        '429':
          $ref: '#/components/responses/tooManyRequests'
        '500':
          $ref: '#/components/responses/internalServerError'
      summary: Assign One Organization API Key to One Project
      tags:
      - Programmatic API Keys
      x-codeSamples:
      - lang: cURL
        label: Atlas CLI
        source: atlas api programmaticApiKeys addGroupApiKey --help
      - lang: go
        label: Go
        source: "import (\n\t\"os\"\n\t\"context\"\n\t\"log\"\n\tsdk \"go.mongodb.org/atlas-sdk/v20250312001/admin\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\tclientID := os.Getenv(\"MONGODB_ATLAS_CLIENT_ID\")\n\tclientSecret := os.Getenv(\"MONGODB_ATLAS_CLIENT_SECRET\")\n\n\t// See https://dochub.mongodb.org/core/atlas-go-sdk-oauth\n\tclient, err := sdk.NewClient(sdk.UseOAuthAuth(clientID, clientSecret))\n\n\tif err != nil {\n\t\tlog.Fatalf(\"Error: %v\", err)\n\t}\n\n\tparams = &sdk.AddGroupApiKeyApiParams{}\n\tsdkResp, httpResp, err := client.ProgrammaticAPIKeysApi.\n\t\tAddGroupApiKeyWithParams(ctx, params).\n\t\tExecute()\n}\n"
      - lang: cURL
        label: curl (Service Accounts)
        source: "curl --include --header \"Authorization: Bearer ${ACCESS_TOKEN}\" \\\n  --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n  --header \"Content-Type: application/json\" \\\n  -X POST \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/apiKeys/{apiUserId}\" \\\n  -d '{ <Payload> }'"
      - lang: cURL
        label: curl (Digest)
        source: "curl --user \"${PUBLIC_KEY}:${PRIVATE_KEY}\" \\\n  --digest --include \\\n  --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n  --header \"Content-Type: application/json\" \\\n  -X POST \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/apiKeys/{apiUserId}\" \\\n  -d '{ <Payload> }'"
      x-rolesRequirements:
      - Project Owner
      x-xgen-docs-url: https://mongodb.com/docs/atlas/reference/api-resources-spec/v2/#tag/Programmatic-API-Keys/operation/addGroupApiKey
      x-xgen-method-verb-override:
        customMethod: 'True'
        verb: add
  /api/atlas/v2/orgs/{orgId}/apiKeys:
    get:
      description: Returns all organization API keys for the specified organization. The organization API keys grant programmatic access to an organization. You can't use the API key to log into MongoDB Cloud through the console. To use this resource, the requesting Service Account or API Key must have the Organization Member role.
      externalDocs:
        description: Programmatic API Keys
        url: https://docs.atlas.mongodb.com/configure-api-access/#std-label-atlas-prog-api-key
      operationId: listOrgApiKeys
      parameters:
      - $ref: '#/components/parameters/envelope'
      - $ref: '#/components/parameters/includeCount'
      - $ref: '#/components/parameters/itemsPerPage'
      - $ref: '#/components/parameters/orgId'
      - $ref: '#/components/parameters/pageNum'
      - $ref: '#/components/parameters/pretty'
      responses:
        '200':
          content:
            application/vnd.atlas.2023-01-01+json:
              schema:
                $ref: '#/components/schemas/PaginatedApiApiUserView'
              x-xgen-version: '2023-01-01'
          description: OK
          headers:
            RateLimit-Limit:
              $ref: '#/components/headers/HeaderRateLimitLimit'
            RateLimit-Remaining:
              $ref: '#/components/headers/HeaderRateLimitRemaining'
        '401':
          $ref: '#/components/responses/unauthorized'
        '403':
          $ref: '#/components/responses/forbidden'
        '404':
          $ref: '#/components/responses/notFound'
        '429':
          $ref: '#/components/responses/tooManyRequests'
        '500':
          $ref: '#/components/responses/internalServerError'
      summary: Return All Organization API Keys
      tags:
      - Programmatic API Keys
      x-codeSamples:
      - lang: cURL
        label: Atlas CLI
        source: atlas api programmaticApiKeys listOrgApiKeys --help
      - lang: go
        label: Go
        source: "import (\n\t\"os\"\n\t\"context\"\n\t\"log\"\n\tsdk \"go.mongodb.org/atlas-sdk/v20250312001/admin\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\tclientID := os.Getenv(\"MONGODB_ATLAS_CLIENT_ID\")\n\tclientSecret := os.Getenv(\"MONGODB_ATLAS_CLIENT_SECRET\")\n\n\t// See https://dochub.mongodb.org/core/atlas-go-sdk-oauth\n\tclient, err := sdk.NewClient(sdk.UseOAuthAuth(clientID, clientSecret))\n\n\tif err != nil {\n\t\tlog.Fatalf(\"Error: %v\", err)\n\t}\n\n\tparams = &sdk.ListOrgApiKeysApiParams{}\n\tsdkResp, httpResp, err := client.ProgrammaticAPIKeysApi.\n\t\tListOrgApiKeysWithParams(ctx, params).\n\t\tExecute()\n}\n"
      - lang: cURL
        label: curl (Service Accounts)
        source: "curl --include --header \"Authorization: Bearer ${ACCESS_TOKEN}\" \\\n  --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n  -X GET \"https://cloud.mongodb.com/api/atlas/v2/orgs/{orgId}/apiKeys?pretty=true\""
      - lang: cURL
        label: curl (Digest)
        source: "curl --user \"${PUBLIC_KEY}:${PRIVATE_KEY}\" \\\n  --digest --include \\\n  --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n  -X GET \"https://cloud.mongodb.com/api/atlas/v2/orgs/{orgId}/apiKeys?pretty=true\""
      x-rolesRequirements:
      - Organization Member
      x-xgen-docs-url: https://mongodb.com/docs/atlas/reference/api-resources-spec/v2/#tag/Programmatic-API-Keys/operation/listOrgApiKeys
    post:
      description: Creates one API key for the specified organization. An organization API key grants programmatic access to an organization. You can't use the API key to log into the console. To use this resource, the requesting Service Account or API Key must have the Organization Owner role.
      externalDocs:
        description: Programmatic API Keys
        url: https://docs.atlas.mongodb.com/configure-api-access/#std-label-atlas-prog-api-key
      operationId: createOrgApiKey
      parameters:
      - $ref: '#/components/parameters/envelope'
      - $ref: '#/components/parameters/orgId'
      - $ref: '#/components/parameters/pretty'
      requestBody:
        content:
          application/vnd.atlas.2023-01-01+json:
            schema:
              $ref: '#/components/schemas/CreateAtlasOrganizationApiKey'
        description: Organization API Key to be created.
        required: true
      responses:
        '200':
          content:
            application/vnd.atlas.2023-01-01+json:
              schema:
                $ref: '#/components/schemas/ApiKeyUserDetails'
              x-xgen-version: '2023-01-01'
          description: OK
          headers:
            RateLimit-Limit:
              $ref: '#/components/headers/HeaderRateLimitLimit'
            RateLimit-Remaining:
              $ref: '#/components/headers/HeaderRateLimitRemaining'
        '401':
          $ref: '#/components/responses/unauthorized'
        '403':
          $ref: '#/components/responses/forbidden'
        '404':
          $ref: '#/components/responses/notFound'
        '429':
          $ref: '#/components/responses/tooManyRequests'
        '500':
          $ref: '#/components/responses/internalServerError'
      summary: Create One Organization API Key
      tags:
      - Programmatic API Keys
      x-codeSamples:
      - lang: cURL
        label: Atlas CLI
        source: atlas api programmaticApiKeys createOrgApiKey --help
      - lang: go
        label: Go
        source: "import (\n\t\"os\"\n\t\"context\"\n\t\"log\"\n\tsdk \"go.mongodb.org/atlas-sdk/v20250312001/admin\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\tclientID := os.Getenv(\"MONGODB_ATLAS_CLIENT_ID\")\n\tclientSecret := os.Getenv(\"MONGODB_ATLAS_CLIENT_SECRET\")\n\n\t// See https://dochub.mongodb.org/core/atlas-go-sdk-oauth\n\tclient, err := sdk.NewClient(sdk.UseOAuthAuth(clientID, clientSecret))\n\n\tif err != nil {\n\t\tlog.Fatalf(\"Error: %v\", err)\n\t}\n\n\tparams = &sdk.CreateOrgApiKeyApiParams{}\n\tsdkResp, httpResp, err := client.ProgrammaticAPIKeysApi.\n\t\tCreateOrgApiKeyWithParams(ctx, params).\n\t\tExecute()\n}\n"
      - lang: cURL
        label: curl (Service Accounts)
        source: "curl --include --header \"Authorization: Bearer ${ACCESS_TOKEN}\" \\\n  --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n  --header \"Content-Type: application/json\" \\\n  -X POST \"https://cloud.mongodb.com/api/atlas/v2/orgs/{orgId}/apiKeys\" \\\n  -d '{ <Payload> }'"
      - lang: cURL
        label: curl (Digest)
        source: "curl --user \"${PUBLIC_KEY}:${PRIVATE_KEY}\" \\\n  --digest --include \\\n  --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n  --header \"Content-Type: application/json\" \\\n  -X POST \"https://cloud.mongodb.com/api/atlas/v2/orgs/{orgId}/apiKeys\" \\\n  -d '{ <Payload> }'"
      x-rolesRequirements:
      - Organization Owner
      x-xgen-docs-url: https://mongodb.com/docs/atlas/reference/api-resources-spec/v2/#tag/Programmatic-API-Keys/operation/createOrgApiKey
  /api/atlas/v2/orgs/{orgId}/apiKeys/{apiUserId}:
    delete:
      description: Removes one organization API key from the specified organization. When you remove an API key from an organization, MongoDB Cloud also removes that key from any projects that use that key. To use this resource, the requesting Service Account or API Key must have the Organization Owner role.
      externalDocs:
        description: Configure Atlas API Access
        url: https://docs.atlas.mongodb.com/configure-api-access/#std-label-enable-api-access-list
      operationId: deleteOrgApiKey
      parameters:
      - $ref: '#/components/parameters/envelope'
      - $ref: '#/components/parameters/orgId'
      - $ref: '#/components/parameters/pretty'
      - description: Unique 24-hexadecimal digit string that identifies this organization API key.
        in: path
        name: apiUserId
        required: true
        schema:
          pattern: ^([a-f0-9]{24})$
          type: string
      responses:
        '204':
          content:
            application/vnd.atlas.2023-01-01+json:
              x-xgen-version: '2023-01-01'
          description: This endpoint does not return a response body.
          headers:
            RateLimit-Limit:
              $ref: '#/components/headers/HeaderRateLimitLimit'
            RateLimit-Remaining:
              $ref: '#/components/headers/HeaderRateLimitRemaining'
        '401':
          $ref: '#/components/responses/unauthorized'
        '403':
          $ref: '#/components/responses/forbidden'
        '404':
          $ref: '#/components/responses/notFound'
        '429':
          $ref: '#/components/responses/tooManyRequests'
        '500':
          $ref: '#/components/responses/internalServerError'
      summary: Remove One Organization API Key
      tags:
      - Programmatic API Keys
      x-codeSamples:
      - lang: cURL
        label: Atlas CLI
        source: atlas api programmaticApiKeys deleteOrgApiKey --help
      - lang: go
        label: Go
        source: "import (\n\t\"os\"\n\t\"context\"\n\t\"log\"\n\tsdk \"go.mongodb.org/atlas-sdk/v20250312001/admin\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\tclientID := os.Getenv(\"MONGODB_ATLAS_CLIENT_ID\")\n\tclientSecret := os.Getenv(\"MONGODB_ATLAS_CLIENT_SECRET\")\n\n\t// See https://dochub.mongodb.org/core/atlas-go-sdk-oauth\n\tclient, err := sdk.NewClient(sdk.UseOAuthAuth(clientID, clientSecret))\n\n\tif err != nil {\n\t\tlog.Fatalf(\"Error: %v\", err)\n\t}\n\n\tparams = &sdk.DeleteOrgApiKeyApiParams{}\n\thttpResp, err := client.ProgrammaticAPIKeysApi.\n\t\tDeleteOrgApiKeyWithParams(ctx, params).\n\t\tExecute()\n}\n"
      - lang: cURL
        label: curl (Service Accounts)
        source: "curl --include --header \"Authorization: Bearer ${ACCESS_TOKEN}\" \\\n  --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n  -X DELETE \"https://cloud.mongodb.com/api/atlas/v2/orgs/{orgId}/apiKeys/{apiUserId}\""
      - lang: cURL
        label: curl (Digest)
        source: "curl --user \"${PUBLIC_KEY}:${PRIVATE_KEY}\" \\\n  --digest --include \\\n  --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n  -X DELETE \"https://cloud.mongodb.com/api/atlas/v2/orgs/{orgId}/apiKeys/{apiUserId}\""
      x-rolesRequirements:
      - Organization Owner
      x-xgen-docs-url: https://mongodb.com/docs/atlas/reference/api-resources-spec/v2/#tag/Programmatic-API-Keys/operation/deleteOrgApiKey
    get:
      description: Returns one organization API key. The organization API keys grant programmatic access to an organization. You can't use the API key to log into MongoDB Cloud through the user interface. To use this resource, the requesting Service Account or API Key must have the  Organization Member role.
      externalDocs:
        description: Programmatic API Keys
        url: https://docs.atlas.mongodb.com/configure-api-access/#std-label-atlas-prog-api-key
      operationId: getOrgApiKey
      parameters:
      - $ref: '

# --- truncated at 32 KB (77 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/mongodb/refs/heads/main/openapi/mongodb-programmatic-api-keys-api-openapi.yml