API Specification
Teams
A team's API keys and the activity feed. Requires a signed-in user; API keys are refused here.
postCreate an API key
Creates a team API key for CI. The secret (`xk_…`) is returned once and stored only as a hash, so the response is unrepeatable by design.
postRevoke an API key
Revokes a key. Verifiers cache a key's answer for up to 30 seconds, so it stops working within that.
postList activity
Reads the audit feed: who did what, to which function, when.
postList API keys
The team's live API keys, including imported `fnt_…` tokens, and when each was last used. Never their secrets.