# client.system_keys

> client.system_keys — the systemKeys operations.

`client.system_keys` — the `systemKeys` operations.

On `AsyncKindgi` every method is the same, awaited.

## `client.system_keys.list()`

```python signature
list(*, timeout: float | None = None) -> SystemKeyList
```

List system keys. `GET /v1/system/keys`

The operator's system keys (`kgi_sy_…`): each acts in no tenant, for one service, with the scopes it was minted with. Newest first, revoked ones too. Never returns secrets. Only the full system capability (`kindgi:system`: the deployment's own token, or a full system key) lists them; on a runtime serving one tenant, the deployment's own token alone.

## `client.system_keys.mint()`

```python signature
mint(
    body: MintSystemKeyBody | Mapping[str, Any] | None = None,
    /,
    *,
    idempotency_key: str | None = None,
    timeout: float | None = None,
    **fields: Any,
) -> MintSystemKeyResult
```

Mint a system key. `POST /v1/system/keys`

A system key (`kgi_sy_…`) is the operator's, for a service that acts for it (sign-up, the orchestrator, billing, the license renewal), with the least scope that service needs. It acts in no tenant: it reaches `/v1/system/*` and the deployment's license, and every other route refuses it (`system-key-on-tenant-route`). Every request it makes is recorded. Only the full system capability (`kindgi:system`: the deployment's own token, or a full system key) mints one, and a key can't outlive the key minting it. Returns the plaintext token exactly once. On a runtime serving one tenant, only the deployment's own token reaches the system keys, and a key holds `system:license` alone: it reads `GET /v1/license` and `GET /v1/license/usage`, for the license renewal, and every other route refuses it.

## `client.system_keys.revoke()`

```python signature
revoke(
    key_id: str | UUID,
    /,
    *,
    idempotency_key: str | None = None,
    timeout: float | None = None,
) -> RevokeSystemKeyResult
```

Revoke a system key. `POST /v1/system/keys/{keyId}/revoke`

Revokes one of the operator's system keys (`kgi_sy_…`) and every key minted from it, however deep (`alsoRevoked`): they stop working on the next request. Revoking a revoked key keeps the first time. Only the full system capability (`kindgi:system`: the deployment's own token, or a full system key) revokes them; on a runtime serving one tenant, the deployment's own token alone.

## `client.system_keys.whoami()`

```python signature
whoami(*, timeout: float | None = None) -> SystemWhoami
```

Which system key this is. `GET /v1/system/whoami`

A system key's own id, scopes and expiry, for a service checking its key: any system principal, on a runtime serving many tenants. A tenant's key or session is refused (`system-principal-required`). `GET /v1/identity/whoami` is a tenant route, which refuses a system key. A runtime serving one tenant answers no one here: its own token is that tenant's outside `/v1/system/keys`, and a system key reads the license routes alone.