List the business's API keys
Every key for this business, revoked ones included. Revoked keys stay visible: after an incident the question is which keys existed and when each stopped working, and hiding them answers neither. Secrets are absent from this response shape entirely.
Every key for this business, revoked ones included.
Revoked keys stay visible: after an incident the question is which keys existed and when each stopped working, and hiding them answers neither. Secrets are absent from this response shape entirely.
Authorization
OAuth2PasswordBearer In: header
Cookie Parameters
Response Body
application/json
application/json
curl -X GET "https://example.com/api/b/v1/api-keys"[ { "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "name": "string", "mode": "test", "key_prefix": "string", "scopes": [ "string" ], "created_at": "2019-08-24T14:15:22Z", "last_used_at": "2019-08-24T14:15:22Z", "revoked_at": "2019-08-24T14:15:22Z", "expires_at": "2019-08-24T14:15:22Z", "replaced_by_id": "a3d84e0a-4d68-4aaf-98ed-4d6a393ea8e5" }]Submit a locked-field change (forces re-verification) POST
File a change to `legal_name` or `registration_number`. When the business is verified the fields are locked: the change is recorded as a pending request, the application moves `in_review`, and live limits drop to the configured safe mode (AC1). The new value is not written to the business - applying it is a compliance operator's decision. When the business is not yet verified the field is not locked and the edit is applied immediately.
Create an API key (secret shown once) POST
Issue a key for the business in the token. The response is the only time the secret exists outside the caller's system. Afterwards only its SHA-256 digest and prefix are stored.