API keys

Create, list and revoke tenant-bound API keys (administrator session).

List API keys

GET /api/apikeys/{tenant}

Authentication: Session of an exoCortex Core administrator

Parameters

Name	In	Type	Required	Description
tenant	path	string	yes	Tenant code (case-insensitive).

Responses

Status	Description
200	Keys of the tenant (secrets are never returned).
401	Not authenticated.
403	Authenticated but not allowed (role, tenant or key).

Example 200

{
  "ok": true,
  "keys": [
    {
      "keyid": "9f2c4e1a7b3d",
      "name": "ERP connector",
      "scopes": [
        "tickets:create",
        "tickets:read"
      ],
      "active": true,
      "created_at": "2026-11-01T08:00:00.000Z",
      "last_used_at": "2026-11-01T09:14:05.000Z"
    }
  ]
}

Example with curl

curl -X GET "https://exocortex-api.ai-exo-cortex.com/api/apikeys/ACME" \
  -H "Authorization: Bearer $EXO_ADMIN_SESSION"

Create an API key

POST /api/apikeys/{tenant}

Returns the full key once. exoCortex stores only a hash of the secret.

Authentication: Session of an exoCortex Core administrator

Parameters

Name	In	Type	Required	Description
tenant	path	string	yes	Tenant code (case-insensitive).

Request body

application/json

Name	Type	Required	Description
name	string	no
scopes	array<string (tickets:create, tickets:read, tickets:comment, tickets:*, *)>	no	Scopes granted to the key. An empty list grants every v1 scope; prefer explicit scopes.

{
  "name": "ERP connector",
  "scopes": [
    "tickets:create",
    "tickets:read"
  ]
}

Responses

Status	Description
200	Key created.
400	Invalid request.
401	Not authenticated.
403	Authenticated but not allowed (role, tenant or key).

Example 200

{
  "ok": true,
  "key": "nhk.9f2c4e1a7b3d.0123456789abcdef0123456789abcdef0123456789abcdef",
  "keyid": "9f2c4e1a7b3d",
  "name": "ERP connector",
  "scopes": [
    "tickets:create",
    "tickets:read"
  ],
  "note": "Copia la chiave ora: non sarà più mostrata."
}

Example with curl

curl -X POST "https://exocortex-api.ai-exo-cortex.com/api/apikeys/ACME" \
  -H "Authorization: Bearer $EXO_ADMIN_SESSION" \
  -H "Content-Type: application/json" \
  --data '{"name":"ERP connector","scopes":["tickets:create","tickets:read"]}'

Revoke an API key

DELETE /api/apikeys/{tenant}/{keyid}

Authentication: Session of an exoCortex Core administrator

Parameters

Name	In	Type	Required	Description
tenant	path	string	yes	Tenant code (case-insensitive).
keyid	path	string	yes

Responses

Status	Description
200	Key revoked. It stops working immediately.
401	Not authenticated.
403	Authenticated but not allowed (role, tenant or key).
404	Resource not found or not configured.

Example 200

{
  "ok": true
}

Example with curl

curl -X DELETE "https://exocortex-api.ai-exo-cortex.com/api/apikeys/ACME/9f2c4e1a7b3d" \
  -H "Authorization: Bearer $EXO_ADMIN_SESSION"

Page generated from the OpenAPI specification of the integration API, version 1.1.0.