# client.system_keys

> client.system_keys — the systemKeys operations.

`client.system_keys` — the `systemKeys` operations.

On `AsyncKindgi` every method is the same, awaited.

## `client.system_keys.list()`

```python signature
list(*, timeout: float | None = None) -> SystemKeyList
```

List system keys. `GET /v1/system/keys`

The operator's system keys (`kgi_sy_…`) on a runtime serving many tenants: each acts in no tenant, for one service, with the scopes it was minted with. Newest first, revoked ones too. Never returns secrets. Only the full system capability (`kindgi:system`: the deployment's own token, or a full system key) lists them.

## `client.system_keys.mint()`

```python signature
mint(
    body: MintSystemKeyBody | Mapping[str, Any] | None = None,
    /,
    *,
    idempotency_key: str | None = None,
    timeout: float | None = None,
    **fields: Any,
) -> MintSystemKeyResult
```

Mint a system key. `POST /v1/system/keys`

A system key (`kgi_sy_…`) is the operator's, for a service that acts for it (sign-up, the orchestrator, billing, the license renewal), with the least scope that service needs. It acts in no tenant: it reaches `/v1/system/*` and the deployment's license, and every other route refuses it (`system-key-on-tenant-route`). Every request it makes is recorded. Only the full system capability (`kindgi:system`: the deployment's own token on a runtime serving many tenants, or a full system key) mints one, and a key can't outlive the key minting it. Returns the plaintext token exactly once. A runtime serving one tenant has no system keys: there, the deployment's own token is that tenant's, and this route isn't mounted.

## `client.system_keys.revoke()`

```python signature
revoke(
    key_id: str | UUID,
    /,
    *,
    idempotency_key: str | None = None,
    timeout: float | None = None,
) -> RevokeSystemKeyResult
```

Revoke a system key. `POST /v1/system/keys/{keyId}/revoke`

Revokes one of the operator's system keys (`kgi_sy_…`) and every key minted from it, however deep (`alsoRevoked`): they stop working on the next request. Revoking a revoked key keeps the first time. Only the full system capability (`kindgi:system`: the deployment's own token, or a full system key) revokes them.

## `client.system_keys.whoami()`

```python signature
whoami(*, timeout: float | None = None) -> SystemWhoami
```

Which system key this is. `GET /v1/system/whoami`

A system key's own id, scopes and expiry, for a service checking its key. Any system principal; a tenant's key or session is refused (`system-principal-required`). `GET /v1/identity/whoami` is a tenant route, which refuses a system key.