Management APIManagement keys

Rotate a management key

Requires keys:write and permission to manage this key. The existing secret stops working immediately. The key ID and scopes remain unchanged. Rotation is forbidden when the target key has scopes beyond the caller's current permissions.

Endpoint playground

Targets https://berrybox.io. Hosted availability is pending. Use a disposable key; this form keeps credentials only until you leave this endpoint or select Clear.

Requires keys:write and permission to manage this key. The existing secret stops working immediately. The key ID and scopes remain unchanged. Rotation is forbidden when the target key has scopes beyond the caller's current permissions.

Authorization

ManagementKey
AuthorizationBearer <token>

A team-bound management key with the endpoint's required scope. Dashboard cookies, sandbox keys, and OIDC tokens are not accepted.

In: header

Path Parameters

apiKeyId*string

The key metadata ID returned by list or create; not the key secret.

Header Parameters

Idempotency-Key?string

Optional team-scoped mutation key, bound to the caller and request. A conflicting or in-progress request returns 409. Completed create and rotate requests also return 409 on replay; their secrets are never stored for replay. Completed revocation requests can replay their result.

Match^[!-~]{1,128}$
Length1 <= length <= 128

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

application/json

curl -X POST "https://example.com/api/management/v1/api-keys/string/rotate"
{  "ok": true,  "type": "api_key.rotated",  "apiKey": {    "id": "string",    "name": "string",    "keyPrefix": "string",    "keyLastFour": "string",    "scopes": [      "teams:read"    ],    "createdAt": "2019-08-24T14:15:22Z",    "expiresAt": "2019-08-24T14:15:22Z",    "lastUsedAt": "2019-08-24T14:15:22Z"  },  "secret": "string"}

Revoke a management key DELETE

Requires keys:write and permission to manage this key. Revocation invalidates its secret. A missing, already revoked, or inaccessible key is not found.

Read recorded billing accounting GET

Requires explicit billing:read and the key creator’s current owner, admin or billing role. Team and account come only from the stored key binding. The exact key generation/scope and membership are checked again in one read-only repeatable snapshot. No caller-supplied team override is supported. Read work has an 8-second transport deadline after the independent key/rate guards. Missing or current-day usage remains unavailable; producer completeness is unverified. No provider IDs, raw usage attributes or private ledger metadata are returned.