API Keys and Exports

Managing API keys

Method	Path	Purpose
GET	/management/keys?workspace_id=	List keys (status / key_type / q, cursor paging)
POST	/management/keys	Create a personal key; plaintext returned once
GET	/management/keys/{id}?workspace_id=	Detail (masked)
PATCH	/management/keys/{id}?workspace_id=	Name / expiry / spending limit (three-state)
POST	/management/keys/{id}/disable	Disable
POST	/management/keys/{id}/enable	Enable
POST	/management/keys/{id}/rotate	Rotate; returns the new plaintext
POST	/management/keys/{id}/rotate/confirm	Confirm rotation
DELETE	/management/keys/{id}?workspace_id=	Revoke (kept as revoked)

• Create/update/delete/rotate require Idempotency-Key.
• Plaintext appears only in the create/rotate response; lists and detail are masked.
• Only key_type=personal is supported; unauthorized access is folded into 404.
• Keys take effect immediately: the gateway rejects a disabled/revoked key at once.

Exports

Method	Path	Purpose
POST	/management/exports	Create a job (`kind=usage	cost	generations, format=csv	json`)
GET	/management/exports	List jobs
GET	/management/exports/{id}	Job status
GET	/management/exports/{id}/download	Download the artifact (409 while not ready)

• Creation requires Idempotency-Key; one job exports at most one page, next_cursor points to the next.
• Artifacts expire after 24 hours; expired or unknown ids return 404.
• Export content matches the online query under the same permissions.
• usage/generations exports mirror the online fields: JSON carries media_units; CSV appends the media columns (image_count / video_seconds / audio_seconds, plus reasoning_tokens for generations), leaving unmetered types empty.