Secret keys

The vendor plane (report section 7.1). These are the credentials the customer's own backend holds; they live in their own table so that a control-plane credential can never be picked up by the snapshot query that feeds a customer's SDK cache.

POST /v1/secret_keys

Answers 201 on success.

Authentication.

• A krsk_ secret key or a krses_ dashboard session, as Authorization: Bearer.

Body. Validated by this schema, from the control plane's own source:

const CreateSecretKey = z.object({
  env: Env,
  name: Name.optional(),
  meta: Meta.optional(),
  expires_at: Timestamp.optional(),
});

GET /v1/secret_keys

Filtered exactly as GET /v1/keys is. A listing of every live credential's display prefix, name and rotation history is the production key namespace, which is the thing a test credential is defined not to reach.

Answers 200 on success.

Authentication.

• A krsk_ secret key or a krses_ dashboard session, as Authorization: Bearer.

GET /v1/secret_keys/:id

Answers 200 on success.

Authentication.

• A krsk_ secret key or a krses_ dashboard session, as Authorization: Bearer.

Path parameters. id.

POST /v1/secret_keys/:id/rotate

Answers 200 on success.

Authentication.

• A krsk_ secret key or a krses_ dashboard session, as Authorization: Bearer.

Path parameters. id.

Body. Validated by this schema, from the control plane's own source:

const RotateSecretKey = z.object({
  overlap_hours: z.number().min(0).max(168).default(24),
});

POST /v1/secret_keys/:id/revoke

Answers 200 on success.

Authentication.

• A krsk_ secret key or a krses_ dashboard session, as Authorization: Bearer.

Path parameters. id.

Body. Validated by this schema, from the control plane's own source:

const RevokeSecretKey = z.object({
  reason: z.string().min(1).max(500).optional(),
});

Shared validators

Defined once in packages/api/src/validation.ts and used by the schemas above.

const Env = z.enum(['live', 'test']);

const Meta = z.record(z.string(), z.unknown());

const Name = z.string().min(1).max(200);

const Timestamp = z.iso.datetime({ offset: true });