Clés API

Create, list and revoke tenant-bound API keys (administrator session).

Lister les clés API

GET /api/apikeys/{tenant}

Authentification: Session d’un administrateur de exoCortex Core

Paramètres

Nom	Emplacement	Type	Obligatoire	Description
tenant	chemin	string	oui	Tenant code (case-insensitive).

Réponses

Statut	Description
200	Keys of the tenant (secrets are never returned).
401	Not authenticated.
403	Authenticated but not allowed (role, tenant or key).

Exemple 200

{
  "ok": true,
  "keys": [
    {
      "keyid": "9f2c4e1a7b3d",
      "name": "ERP connector",
      "scopes": [
        "tickets:create",
        "tickets:read"
      ],
      "active": true,
      "created_at": "2026-11-01T08:00:00.000Z",
      "last_used_at": "2026-11-01T09:14:05.000Z"
    }
  ]
}

Exemple avec curl

curl -X GET "https://exocortex-api.ai-exo-cortex.com/api/apikeys/ACME" \
  -H "Authorization: Bearer $EXO_ADMIN_SESSION"

Créer une clé API

POST /api/apikeys/{tenant}

Returns the full key once. exoCortex stores only a hash of the secret.

Authentification: Session d’un administrateur de exoCortex Core

Paramètres

Nom	Emplacement	Type	Obligatoire	Description
tenant	chemin	string	oui	Tenant code (case-insensitive).

Corps de la requête

application/json

Nom	Type	Obligatoire	Description
name	string	non
scopes	array<string (tickets:create, tickets:read, tickets:comment, tickets:*, *)>	non	Scopes granted to the key. An empty list grants every v1 scope; prefer explicit scopes.

{
  "name": "ERP connector",
  "scopes": [
    "tickets:create",
    "tickets:read"
  ]
}

Réponses

Statut	Description
200	Key created.
400	Invalid request.
401	Not authenticated.
403	Authenticated but not allowed (role, tenant or key).

Exemple 200

{
  "ok": true,
  "key": "nhk.9f2c4e1a7b3d.0123456789abcdef0123456789abcdef0123456789abcdef",
  "keyid": "9f2c4e1a7b3d",
  "name": "ERP connector",
  "scopes": [
    "tickets:create",
    "tickets:read"
  ],
  "note": "Copia la chiave ora: non sarà più mostrata."
}

Exemple avec curl

curl -X POST "https://exocortex-api.ai-exo-cortex.com/api/apikeys/ACME" \
  -H "Authorization: Bearer $EXO_ADMIN_SESSION" \
  -H "Content-Type: application/json" \
  --data '{"name":"ERP connector","scopes":["tickets:create","tickets:read"]}'

Révoquer une clé API

DELETE /api/apikeys/{tenant}/{keyid}

Authentification: Session d’un administrateur de exoCortex Core

Paramètres

Nom	Emplacement	Type	Obligatoire	Description
tenant	chemin	string	oui	Tenant code (case-insensitive).
keyid	chemin	string	oui

Réponses

Statut	Description
200	Key revoked. It stops working immediately.
401	Not authenticated.
403	Authenticated but not allowed (role, tenant or key).
404	Resource not found or not configured.

Exemple 200

{
  "ok": true
}

Exemple avec curl

curl -X DELETE "https://exocortex-api.ai-exo-cortex.com/api/apikeys/ACME/9f2c4e1a7b3d" \
  -H "Authorization: Bearer $EXO_ADMIN_SESSION"

Page générée à partir de la spécification OpenAPI de l’API d’intégration, version 1.1.0.