Trajectory API Keys API

openapi: 3.2.0
info:
  title: Trajectory API Keys API
  version: 0.1.0
  x-trajectory-api-version: '2026-10-14'
  description: This contract is API version 2026-10-14. The optional Trajectory-API-Version header pins it, and tmp-contract is accepted as an alias. Requests without the header get this version. Version 2026-10-07 and the pre-launch legacy response formats are retired.
tags:
- name: API Keys
paths:
  /api/v1/organizations/{organization_id}/api-keys:
    get:
      tags:
      - API Keys
      summary: List Api Keys
      operationId: listApiKeys
      parameters:
      - name: organization_id
        in: path
        required: true
        schema:
          type: string
          title: Organization Id
      - name: cursor
        in: query
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          title: Cursor
      - name: limit
        in: query
        required: false
        schema:
          type: integer
          maximum: 200
          minimum: 1
          default: 25
          title: Limit
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiKeyListResponse'
      x-trajectory-visibility: browser
    post:
      tags:
      - API Keys
      summary: Create Api Key
      operationId: createApiKey
      parameters:
      - name: organization_id
        in: path
        required: true
        schema:
          type: string
          title: Organization Id
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateApiKeyRequest'
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateApiKeyResponse'
      x-trajectory-visibility: browser
  /api/v1/organizations/{organization_id}/api-keys/{key_hash}:
    delete:
      tags:
      - API Keys
      summary: Revoke Api Key
      operationId: revokeApiKey
      parameters:
      - name: organization_id
        in: path
        required: true
        schema:
          type: string
          title: Organization Id
      - name: key_hash
        in: path
        required: true
        schema:
          type: string
          title: Key Hash
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RevokeApiKeyResponse'
      x-trajectory-visibility: browser
components:
  schemas:
    ApiKey:
      properties:
        key_hash:
          type: string
          title: Key Hash
          description: Opaque identifier for the key (SHA-256 of the secret). Used to reference the key when revoking it; the secret itself is never returned after creation.
        key_prefix:
          type: string
          title: Key Prefix
          description: Non-secret prefix shown to help identify the key.
        name:
          type: string
          title: Name
          description: Human-readable label for the key.
        created_at:
          anyOf:
          - type: string
            format: date-time
          - type: 'null'
          title: Created At
          description: UTC timestamp the key was created.
        last_used_at:
          anyOf:
          - type: string
            format: date-time
          - type: 'null'
          title: Last Used At
          description: UTC timestamp the key was last used to authenticate, if ever.
      type: object
      required:
      - key_hash
      - key_prefix
      - name
      title: ApiKey
    CreateApiKeyRequest:
      properties:
        name:
          type: string
          title: Name
          description: Human-readable label for the new key.
      type: object
      required:
      - name
      title: CreateApiKeyRequest
    CreateApiKeyResponse:
      properties:
        api_key:
          $ref: '#/components/schemas/ApiKey'
          description: Metadata for the newly created key.
        secret:
          type: string
          title: Secret
          description: The plaintext API key. Returned only once at creation and never again — the caller must surface it to the user immediately.
      type: object
      required:
      - api_key
      - secret
      title: CreateApiKeyResponse
    RevokeApiKeyResponse:
      properties:
        key_hash:
          type: string
          title: Key Hash
          description: Identifier of the key that was revoked.
      type: object
      required:
      - key_hash
      title: RevokeApiKeyResponse
    ApiKeyListResponse:
      properties:
        items:
          items:
            $ref: '#/components/schemas/ApiKey'
          type: array
          title: Items
          description: Page of the organization's active API keys.
        next_cursor:
          anyOf:
          - type: string
          - type: 'null'
          title: Next Cursor
          description: Cursor for the next page, or null if none.
        has_more:
          type: boolean
          title: Has More
          description: True if more API keys remain beyond this page.
      type: object
      required:
      - items
      - has_more
      title: ApiKeyListResponse
  securitySchemes:
    TrajectoryAccessToken:
      type: http
      description: Short-lived token scoped to one rollout trajectory
      scheme: bearer
    InferenceAuthorization:
      type: http
      scheme: bearer