ReferenceControl-plane API
Control-plane API
The closed control plane at KEYRING_BASE_URL, one page per resource.
The control plane is a NestJS application on Fastify. The hosted one is at https://keyring-api.belghalem.fr; a self-hosted one is wherever you put the api zone. Every SDK and every dashboard action goes through it, and nothing on your request path does: the SDK talks to it in the background only.
Authentication
| Credential | Prefix | Who holds it | Where it authenticates |
|---|---|---|---|
| Secret key | krsk_ | Your servers and scripts | Every /v1/* resource as Authorization: Bearer |
| Dashboard session | krses_ | The dashboard's server, never a browser | The same resources, plus /v1/auth/* |
| Embed token | a JWT | Your customer's browser, five minutes | /v1/embed/* only, scoped to one tenant |
| Bootstrap token | configured | A provisioning job | POST /v1/workspaces only |
A krsk_test_ secret key is confined to test mode: Test mode has the boundary, and Responses has the error envelope every refusal uses.
Conventions
- Bodies and query strings are validated by the zod schema shown on each endpoint. A failure is
400 invalid_requestwith adetailslist of field paths. - Every mutation writes an audit row in the same transaction, except the endpoints that scale with your customers' traffic: telemetry ingest, rate-limit checks, idempotency claims and embed-token minting. Those write none and take no lock, on purpose.
- The workspace always comes from the credential, never from a parameter, and every
project_idortenant_idin a request is re-checked against it. - The hosted control plane runs in the EU only.