id
required |
string (uuid)
|
Unique identifier of the API key record
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
|
name
required |
string
|
Human-friendly label used to identify the key in UI and logs
nullable
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
|
keyPrefix
required |
string
|
Gets or sets the leading characters of the key value, safe to display. `null` for a key
the rewrap backfill has not reached.
nullable
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
|
last4
required |
string
|
Gets or sets the trailing characters of the key value, safe to display. `null` for a key
the rewrap backfill has not reached.
nullable
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
|
environment
required |
ApiKeyEnvironment
ApiKeyEnvironment |
Gets or sets which world the key acts in, or `null` when it has never been stamped.
nullable
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
Test |
The key acts against the processor's test host. No live money moves. Minted with the sk_test_ prefix. | Live |
The key acts against the processor's live host. Minted with the sk_live_ prefix. |
|
status
required |
ApiKeyStatus
ApiKeyStatus |
Gets or sets the key's administrative state.
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
Active |
The key is in service. Whether it is currently accepted also depends on its expiry. | Revoked |
The key has been revoked and is rejected at authentication for good. Revoked keys are retained rather than deleted so the audit trail of what the key did survives it. | Suspended |
The key has been put out of service temporarily, pending someone deciding whether the use that triggered it was legitimate. Rejected at authentication exactly as a revoked key is, and reinstatable, which is the whole reason it is not one. |
|
maskedKey
required |
string
|
Gets the key's display form: its retained prefix, an ellipsis, and its last characters. This
is the only representation of the value any read path carries.
nullableread only
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
|
lastUsedAt
required |
string (date-time)
|
Gets or sets the UTC instant the key was last used to authenticate, or `null` when it
has no recorded use.
nullable
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
|
creationTime
required |
string (date-time)
|
Gets or sets the UTC instant the key was created.
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
|
merchantId
required |
string (uuid)
|
Gets or sets the merchant the key was minted for, or `null` when it is not tied to one.
nullable
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
|
active
required |
boolean
|
Indicates whether the key is currently enabled for use
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
|
expireAt
required |
string (date-time)
|
Optional UTC timestamp when the key will expire (null means no expiration)
nullable
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
|
userId
required |
string (uuid)
|
Identifier of the user or service account that owns this key
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
|
replacesKeyId
required |
string (uuid)
|
Gets or sets the key this one was minted to replace, or `null` when it was not created
by a rotation.
nullable
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
|
replacedByKeyId
required |
string (uuid)
|
Gets or sets the key minted to replace this one, or `null` when it has not been rotated.
nullable
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
|
overlapExpiresAt
required |
string (date-time)
|
Gets or sets when this key's rotation overlap closes and it stops authenticating, or
`null` when it is not in one.
nullable
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
|
allowedCidrs
required |
array of string
array of |
Gets or sets the source addresses this key may be used from, as CIDR ranges or bare
addresses, or `null` when it is not bound to any and may be used from anywhere.
nullable
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
|
scopes
required |
array of string
array of |
Gets or sets the capability scopes this key is restricted to, or `null` when it is
unrestricted and may reach everything its owner can.
nullable
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
|