client.system_keys

client.system_keys — the systemKeys operations.

On AsyncKindgi every method is the same, awaited.

client.system_keys.list()

list(*, timeout: float | None = None) -> SystemKeyList

Signature

List system keys. GET /v1/system/keys

The operator's system keys (kgi_sy_…): each acts in no tenant, for one service, with the scopes it was minted with. Newest first, revoked ones too. Never returns secrets. Only the full system capability (kindgi:system: the deployment's own token, or a full system key) lists them; on a runtime serving one tenant, the deployment's own token alone.

client.system_keys.mint()

mint(
    body: MintSystemKeyBody | Mapping[str, Any] | None = None,
    /,
    *,
    idempotency_key: str | None = None,
    timeout: float | None = None,
    **fields: Any,
) -> MintSystemKeyResult

Signature

Mint a system key. POST /v1/system/keys

A system key (kgi_sy_…) is the operator's, for a service that acts for it (sign-up, the orchestrator, billing, the license renewal), with the least scope that service needs. It acts in no tenant: it reaches /v1/system/* and the deployment's license, and every other route refuses it (system-key-on-tenant-route). Every request it makes is recorded. Only the full system capability (kindgi:system: the deployment's own token, or a full system key) mints one, and a key can't outlive the key minting it. Returns the plaintext token exactly once. On a runtime serving one tenant, only the deployment's own token reaches the system keys, and a key holds system:license alone: it reads GET /v1/license and GET /v1/license/usage, for the license renewal, and every other route refuses it.

client.system_keys.revoke()

revoke(
    key_id: str | UUID,
    /,
    *,
    idempotency_key: str | None = None,
    timeout: float | None = None,
) -> RevokeSystemKeyResult

Signature

Revoke a system key. POST /v1/system/keys/{keyId}/revoke

Revokes one of the operator's system keys (kgi_sy_…) and every key minted from it, however deep (alsoRevoked): they stop working on the next request. Revoking a revoked key keeps the first time. Only the full system capability (kindgi:system: the deployment's own token, or a full system key) revokes them; on a runtime serving one tenant, the deployment's own token alone.

client.system_keys.whoami()

whoami(*, timeout: float | None = None) -> SystemWhoami

Signature

Which system key this is. GET /v1/system/whoami

A system key's own id, scopes and expiry, for a service checking its key: any system principal, on a runtime serving many tenants. A tenant's key or session is refused (system-principal-required). GET /v1/identity/whoami is a tenant route, which refuses a system key. A runtime serving one tenant answers no one here: its own token is that tenant's outside /v1/system/keys, and a system key reads the license routes alone.