Xeonr Developer Docs
API SpecificationNamespaces

Issue API Key

POST
/containers.api.v1.NamespaceService/IssueApiKey

Issues a machine API key owned by this namespace with role (UNSPECIFIED means OPERATOR): a Xeonr Auth API key bound to the namespace, and with workspace_ids set, confined to those workspaces as well. expires_at_unix sets when it stops working (0: never). The plaintext (xk_…) is returned once and never again. A key issued before keys moved to Xeonr Auth (cpk_…) keeps working unchanged. Keys never carry platform-admin rights.

Access: admin role in the namespace (the owning team's admins, or an ADMIN-role namespace API key), or a platform admin. Other callers get NotFound.

Authorization

BearerAuth
AuthorizationBearer <token>

A namespace-scoped API key (cpk_…) for machines, or a Xeonr Auth OIDC token for humans. The key's namespace and role are pinned server-side.

In: header

Header Parameters

Connect-Protocol-Version?number

Define the version of the Connect protocol

Connect-Timeout-Ms?number

Define the timeout, in ms

Request Body

application/json

namespace?string
Length1 <= length <= 64
name?string
Lengthlength <= 255
role?string

UNSPECIFIED issues an OPERATOR key. enum.defined_only = true

Value in"ROLE_UNSPECIFIED" | "ROLE_VIEWER" | "ROLE_OPERATOR" | "ROLE_ADMIN"
workspaceIds?workspace_ids

Confines the key to these workspaces within the namespace, at role. Empty is the whole namespace.

Itemsitems <= 49
description?string
Lengthlength <= 512
expiresAtUnix?string

When the key stops working, unix seconds; 0 is never. Must be in the future, and within the application's key policy where it sets a maximum lifetime.

Formatint64
Range0 <= value
[key: string]?never

Response Body

application/json

application/json

curl -X POST "https://containers.xeonr.io/containers.api.v1.NamespaceService/IssueApiKey" \  -H "Connect-Protocol-Version: 1" \  -H "Connect-Timeout-Ms: 1000" \  -H "Content-Type: application/json" \  -d '{}'
{
  "key": {
    "keyId": "string",
    "namespace": "string",
    "name": "string",
    "role": "ROLE_UNSPECIFIED",
    "createdAtUnix": "string",
    "lastUsedAtUnix": "string",
    "workspaceIds": [
      "string"
    ],
    "keyPrefix": "string",
    "legacyPrefix": "string",
    "expiresAtUnix": "string",
    "revokedAtUnix": "string",
    "description": "string",
    "createdBy": "string"
  },
  "plaintext": "string"
}
{
  "code": "not_found",
  "message": "string",
  "details": [
    {
      "type": "string",
      "value": "string",
      "debug": {}
    }
  ]
}

Get Namespace POST

Returns a namespace record. A namespace the caller cannot see is reported as NotFound. **Access:** any role in the namespace, or a platform admin.

List API Keys POST

Lists a namespace's live API keys (and its revoked ones with `include_revoked`), including its workloads' agent keys (metadata only; plaintext is never returned). `key_id` is the key's Xeonr Auth URN. **Access:** admin role in the namespace (the owning team's admins, or an ADMIN-role namespace API key), or a platform admin. Other callers get NotFound.