# ApiKeyRevealedDto

A model the API reference uses in a request or a response. The operation pages link every field typed as this model here.

A newly created API key, including its plaintext value.

## Fields
- `id` (string(uuid))
- `name` (string): Gets or sets the display name of the API key. (nullable)
- `keyPrefix` (string): Gets or sets the leading characters of the key value, safe to display. `null` for a key  the rewrap backfill has not reached. (nullable)
- `last4` (string): Gets or sets the trailing characters of the key value, safe to display. `null` for a key  the rewrap backfill has not reached. (nullable)
- `environment` ([ApiKeyEnvironment](https://devportal.demo.winkpg.io/docs/api/models/ApiKeyEnvironment.md)): Gets or sets which world the key acts in, or `null` when it has never been stamped. (nullable)
  Values:
  - `Test`: The key acts against the processor's test host. No live money moves. Minted with the sk_test_ prefix.
  - `Live`: The key acts against the processor's live host. Minted with the sk_live_ prefix.
- `status` ([ApiKeyStatus](https://devportal.demo.winkpg.io/docs/api/models/ApiKeyStatus.md)): Gets or sets the key's administrative state.
  Values:
  - `Active`: The key is in service. Whether it is currently accepted also depends on its expiry.
  - `Revoked`: The key has been revoked and is rejected at authentication for good. Revoked keys are retained rather than deleted so the audit trail of what the key did survives it.
  - `Suspended`: The key has been put out of service temporarily, pending someone deciding whether the use that triggered it was legitimate. Rejected at authentication exactly as a revoked key is, and reinstatable, which is the whole reason it is not one.
- `maskedKey` (string): Gets the key's display form: its retained prefix, an ellipsis, and its last characters. This  is the only representation of the value any read path carries. (nullable, read only)
- `lastUsedAt` (string(date-time)): Gets or sets the UTC instant the key was last used to authenticate, or `null` when it  has no recorded use. (nullable)
- `creationTime` (string(date-time)): Gets or sets the UTC instant the key was created.
- `merchantId` (string(uuid)): Gets or sets the merchant the key was minted for, or `null` when it is not tied to one. (nullable)
- `active` (boolean): Gets or sets a value indicating whether the API key is active.
- `expireAt` (string(date-time)): Gets or sets the expiration date for the API key. Null indicates the key does not expire. (nullable)
- `userId` (string(uuid)): Gets or sets the user ID that owns this API key.
- `replacesKeyId` (string(uuid)): Gets or sets the key this one was minted to replace, or `null` when it was not created  by a rotation. (nullable)
- `replacedByKeyId` (string(uuid)): Gets or sets the key minted to replace this one, or `null` when it has not been rotated. (nullable)
- `overlapExpiresAt` (string(date-time)): Gets or sets when this key's rotation overlap closes and it stops authenticating, or  `null` when it is not in one. (nullable)
- `allowedCidrs` (array<string>): Gets or sets the source addresses this key may be used from, as CIDR ranges or bare  addresses, or `null` when it is not bound to any and may be used from anywhere. (nullable)
- `scopes` (array<string>): Gets or sets the capability scopes this key is restricted to, or `null` when it is  unrestricted and may reach everything its owner can. (nullable)
- `key` (string): Gets or sets the plaintext API key value. Shown once, at creation, and never again. (nullable)
- `replacedKeyOverlapExpiresAt` (string(date-time)): Gets or sets when the key this one replaced stops authenticating, or `null` when this key  was not created by a rotation, or was created by one that cut over immediately. (nullable)

## See also

- [All documentation](https://devportal.demo.winkpg.io/llms.txt): the machine-readable index of every public page on this site.