API keys

Server

Long-lived service-account credentials.

List API keys for the caller's org

GET

http://localhost:8080/auth

/api-keys

Raw tokens are never returned again after creation.

List API keys for the caller's org › Responses

Every API key in the caller's org.

ApiKey[]

ApiKey

id

string · required

org_id

string · required

role

string · required

site_ids

string[]

expires_at

string | null · date-time

revoked_at

string | null · date-time

created_at

string · date-time

last_used_at

string | null · date-time

Issue a long-lived service-account token

POST

http://localhost:8080/auth

/api-keys

The raw token is only ever returned here, at creation time.

Issue a long-lived service-account token › Request Body

role

string · enum · required

Enum values:

admin

operator

viewer

service

site_ids

array | null

Omit or null for whole-org access.

expires_in_seconds

integer | null

Omit or null for no expiry.

Issue a long-lived service-account token › Responses

Created. token is shown once.

id

string

role

string

site_ids

string[]

token

string

Revoke an API key

DELETE

http://localhost:8080/auth

/api-keys/{id}

Marks the key revoked and adds its jti to the denylist the gateway's periodic poller consumes - takes effect gateway-side within one poll interval (default 30s), not instantly.

Revoke an API key › path Parameters

id

string · required

Revoke an API key › Responses

Revoked. No response body.

No data returned

Auth Directory

Baler Auth API

API keys

Server

Long-lived service-account credentials.

List API keys for the caller's org

GET

http://localhost:8080/auth

/api-keys

Raw tokens are never returned again after creation.

List API keys for the caller's org › Responses

Every API key in the caller's org.

ApiKey[]

ApiKey

id

string · required

org_id

string · required

role

string · required

site_ids

string[]

expires_at

string | null · date-time

revoked_at

string | null · date-time

created_at

string · date-time

last_used_at

string | null · date-time

Issue a long-lived service-account token

POST

http://localhost:8080/auth

/api-keys

The raw token is only ever returned here, at creation time.

Issue a long-lived service-account token › Request Body

role

string · enum · required

Enum values:

admin

operator

viewer

service

site_ids

array | null

Omit or null for whole-org access.

expires_in_seconds

integer | null

Omit or null for no expiry.

Issue a long-lived service-account token › Responses

Created. token is shown once.

id

string

role

string

site_ids

string[]

token

string

Revoke an API key

DELETE

http://localhost:8080/auth

/api-keys/{id}

Marks the key revoked and adds its jti to the denylist the gateway's periodic poller consumes - takes effect gateway-side within one poll interval (default 30s), not instantly.

Revoke an API key › path Parameters

id

string · required

Revoke an API key › Responses

Revoked. No response body.

No data returned

Auth Directory