Skip to content
Kindgi

List system keys

View as Markdown
GET
/v1/system/keys
curl --request GET \
  --url https://example.com/v1/system/keys \
  --header 'Authorization: Bearer <token>'

The operator’s system keys (kgi_sy_…): each acts in no tenant, for one service, with the scopes it was minted with. Newest first, revoked ones too. Never returns secrets. Only the full system capability (kindgi:system: the deployment’s own token, or a full system key) lists them; on a runtime serving one tenant, the deployment’s own token alone.

Authorizations

Section titled “Authorizations”

Responses

Section titled “Responses”

200

Section titled “200”

The system keys.

Media typeapplication/json
object
data
required
Array<object>

A system key (kgi_sy_…): the operator’s, acting in no tenant. Never its secret.

object
id
required

The key’s id.

string
label

What the key is for, as given at mint.

string
scopes
required
Array<string>
Allowed values: system:tenants system:tenants:create system:tenants:image-prefix system:tenants:production system:tenants:limits system:tenants:contacts system:tenants:purge system:suspend system:deployments system:pack-env system:usage:read system:license kindgi:system
createdAt
required
string format: date-time
expiresAt
string format: date-time
revokedAt
string format: date-time
mintedBy
required

Who minted it: a system key’s id, or boot for the deployment’s own token.

string
Example
{
  "data": [
    {
      "scopes": [
        "system:tenants"
      ]
    }
  ]
}

401

Section titled “401”

Missing / malformed / expired / revoked bearer token.

Media typeapplication/json
object
error
required
object
code
required

Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).

string
message
required
string
details

Optional, kind-specific.

object
key
additional properties
any
requestId
required

Server-assigned request id; also echoed via X-Request-Id header.

string
Examplegenerated
{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}

403

Section titled “403”

A tenant’s key or session (system-principal-required), or a scoped system key (system-scope-missing; on a runtime serving one tenant, system-key-scope-not-served for one holding anything but system:license).

Media typeapplication/json
object
error
required
object
code
required

Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).

string
message
required
string
details

Optional, kind-specific.

object
key
additional properties
any
requestId
required

Server-assigned request id; also echoed via X-Request-Id header.

string
Examplegenerated
{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}

See also