OpenRelay API Keys API

openapi: 3.1.0
info:
  description: 'The OpenRelay control-plane REST API. Deploy GPU VMs and inference clusters, manage organizations and billing, and automate your infrastructure. All requests are authenticated with an API key (`vl_…`) unless noted otherwise.

    '
  title: OpenRelay Account API Keys API
  version: 0.1.0
servers:
- description: Production
  url: https://api.openrelay.inc
- description: Beta
  url: https://api.beta.openrelay.inc
- description: Local development
  url: http://localhost:8083
tags:
- description: Programmatic access keys (vl_…) used to authenticate with this API.
  name: API Keys
paths:
  /v1/orgs/{orgId}/api-keys:
    get:
      operationId: listOrgApiKeys
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                items:
                  $ref: '#/components/schemas/ApiKeySummary'
                type: array
          description: API keys
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
      security:
      - apiKey: []
      summary: List an org's API keys (no secrets)
      tags:
      - API Keys
  /v1/orgs/{orgId}/api-keys/create:
    post:
      operationId: createOrgApiKey
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            example:
              name: ci-deploy
              scopes:
              - clusters:read
              - clusters:write
              - vms:read
            schema:
              $ref: '#/components/schemas/CreateApiKeyRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateApiKeyResult'
          description: Created
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
      security:
      - apiKey: []
      summary: Create an API key (returns the plaintext once)
      tags:
      - API Keys
  /v1/orgs/{orgId}/api-keys/{id}:
    delete:
      operationId: revokeOrgApiKey
      parameters:
      - in: path
        name: orgId
        required: true
        schema:
          type: string
      - in: path
        name: id
        required: true
        schema:
          type: string
      responses:
        '204':
          description: Revoked
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
      security:
      - apiKey: []
      summary: Revoke an API key
      tags:
      - API Keys
      x-openrelay-mcp:
        destructiveHint: true
components:
  schemas:
    CreateApiKeyResult:
      properties:
        createdAt:
          type: string
        id:
          type: string
        key:
          description: Plaintext key — shown once
          type: string
        keyPrefix:
          type: string
        name:
          type: string
        organizationId:
          description: The organization this key is bound to. Every API key belongs to exactly one organization; keep this id alongside the key so callers can build org-scoped request paths without a separate lookup (GET /v1/whoami returns the same id for an existing key).
          type: string
        scopes:
          items:
            type: string
          type: array
      required:
      - id
      - key
      - keyPrefix
      - name
      - scopes
      - createdAt
      - organizationId
      type: object
    ApiKeySummary:
      properties:
        createdAt:
          type: string
        expiresAt:
          type: string
        id:
          type: string
        keyPrefix:
          type: string
        lastUsedAt:
          type: string
        name:
          type: string
        revokedAt:
          type: string
        scopes:
          items:
            type: string
          type: array
      required:
      - id
      - name
      - keyPrefix
      - scopes
      - createdAt
      type: object
    CreateApiKeyRequest:
      properties:
        expiresInSeconds:
          description: Optional server-side expiry, in seconds from now. When set (and > 0) the key stops authenticating after this many seconds, capping the leak window regardless of any client-side cleanup. Omitted or <= 0 means the key never expires (the default).
          format: int64
          type: integer
        name:
          type: string
        scopes:
          description: 'Supported values: clusters:read, clusters:write, vms:read, vms:write, inference.'
          items:
            type: string
          type: array
      required:
      - name
      type: object
    Error:
      properties:
        code:
          type: string
        error:
          type: string
      required:
      - error
      type: object
  responses:
    Forbidden:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
      description: API key lacks the required scope
    Unauthorized:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
      description: Missing or invalid API key
    BadRequest:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
      description: The request is invalid
  securitySchemes:
    apiKey:
      description: 'OpenRelay API key. Send it as `Authorization: Bearer vl_…`.'
      scheme: bearer
      type: http