Xeonr Developer Docs
API SpecificationNamespaces

List API Keys

POST
/containers.api.v1.NamespaceService/ListApiKeys

Lists a namespace's live API keys (and its revoked ones with include_revoked), including its workloads' agent keys (metadata only; plaintext is never returned). key_id is the key's Xeonr Auth URN.

Access: admin role in the namespace (the owning team's admins, or an ADMIN-role namespace API key), or a platform admin. Other callers get NotFound.

Authorization

BearerAuth
AuthorizationBearer <token>

A namespace-scoped API key (cpk_…) for machines, or a Xeonr Auth OIDC token for humans. The key's namespace and role are pinned server-side.

In: header

Header Parameters

Connect-Protocol-Version?number

Define the version of the Connect protocol

Connect-Timeout-Ms?number

Define the timeout, in ms

Request Body

application/json

namespace?string
Lengthlength <= 64
includeRevoked?boolean

Also return revoked keys, for the audit trail; they cannot authenticate. validate:skip a bool has no out-of-range value

[key: string]?never

Response Body

application/json

application/json

curl -X POST "https://containers.xeonr.io/containers.api.v1.NamespaceService/ListApiKeys" \  -H "Connect-Protocol-Version: 1" \  -H "Connect-Timeout-Ms: 1000" \  -H "Content-Type: application/json" \  -d '{}'
{
  "keys": [
    {
      "keyId": "string",
      "namespace": "string",
      "name": "string",
      "role": "ROLE_UNSPECIFIED",
      "createdAtUnix": "string",
      "lastUsedAtUnix": "string",
      "workspaceIds": [
        "string"
      ],
      "keyPrefix": "string",
      "legacyPrefix": "string",
      "expiresAtUnix": "string",
      "revokedAtUnix": "string",
      "description": "string",
      "createdBy": "string"
    }
  ]
}
{
  "code": "not_found",
  "message": "string",
  "details": [
    {
      "type": "string",
      "value": "string",
      "debug": {}
    }
  ]
}

Issue API Key POST

Issues a machine API key owned by this namespace with `role` (UNSPECIFIED means OPERATOR): a Xeonr Auth API key bound to the namespace, and with `workspace_ids` set, confined to those workspaces as well. `expires_at_unix` sets when it stops working (0: never). The plaintext (`xk_…`) is returned once and never again. A key issued before keys moved to Xeonr Auth (`cpk_…`) keeps working unchanged. Keys never carry platform-admin rights. **Access:** admin role in the namespace (the owning team's admins, or an ADMIN-role namespace API key), or a platform admin. Other callers get NotFound.

List Namespaces POST

Lists the namespaces visible to the caller, ordered by name. `page_size` 0 means 100 and is clamped to 1000; `page_token` is the opaque offset from `next_page_token`. **Access:** any authenticated caller; results are filtered to namespaces the caller can read (all of them for a platform admin).