api_key

The api_key domain has 8 actions. On the meta surface they are all reached through arcane_api_key; on the individual surface each one is its own tool; on the dynamic surface run them with arcane_execute_action and the canonical ID.

Summary

Action	Title	Kind
api_key.create	Create an API key	write
api_key.delete	Delete an API key	destructive
api_key.get	Get an API key	read
api_key.list	List API keys	read
api_key.my_create	Create my API key	write
api_key.my_delete	Delete my API key	destructive
api_key.my_list	List my API keys	read
api_key.update	Update an API key	write

Actions

api_key.create

Create an API key

Create a new API key for programmatic access

• Kind: write
• Required parameters: name, permissions
• Meta tool: arcane_api_key with "action": "create"
• Individual tool: arcane_api_key_create
• Arcane route: POST /api/api-keys
• Operation ID: create-api-key
• Usage: Creates a scoped key with an explicit permissions list ([{permission, environmentId?}], names from role.permissions), capped by both the caller’s and the owner’s own permissions. The secret (key, arc_…) is returned only in this answer. For a key that simply carries your own role permissions use api_key.my_create.
• Related actions: api_key.my_create, role.permissions, api_key.update

api_key.delete

Delete an API key

Delete an API key by ID

• Kind: destructive — requires confirm: true
• Required parameters: id
• Meta tool: arcane_api_key with "action": "delete"
• Individual tool: arcane_api_key_delete
• Arcane route: DELETE /api/api-keys/{id}
• Operation ID: delete-api-key
• Usage: Revokes any key by id (from api_key.list, needs apikeys:delete) at once: anything authenticating with it starts failing. Static keys and keys an environment uses as its pairing key (isStatic/isBootstrap in api_key.get) are refused with 403.
• Related actions: api_key.list, api_key.my_delete

api_key.get

Get an API key

Get details of a specific API key by ID

• Kind: read
• Required parameters: id
• Meta tool: arcane_api_key with "action": "get"
• Individual tool: arcane_api_key_get
• Arcane route: GET /api/api-keys/{id}
• Operation ID: get-api-key
• Usage: One key by id (from api_key.list, api_key.my_list or the create answer). Needs apikeys:read. Returns name, description, keyPrefix, owner userId, kind (scoped, or personal which carries no grants and inherits the owner’s roles), expiresAt, lastUsedAt, permissions, and isStatic/isBootstrap (true means api_key.update and api_key.delete refuse it). The secret is never shown again after creation, and an unknown id answers 404.
• Related actions: api_key.list, api_key.update, api_key.delete

api_key.list

List API keys

Get a paginated list of API keys

• Kind: read
• Required parameters: none
• Meta tool: arcane_api_key with "action": "list"
• Individual tool: arcane_api_key_list
• Arcane route: GET /api/api-keys
• Operation ID: list-api-keys
• Usage: Every API key of the instance, whoever owns it, with its grants (needs apikeys:list). Secrets are never returned. For your own keys use api_key.my_list.
• Related actions: api_key.get, api_key.my_list

api_key.my_create

Create my API key

Create a new personal API key owned by the current user. Personal keys inherit the owner’s role permissions.

• Kind: write
• Required parameters: name
• Meta tool: arcane_api_key with "action": "my_create"
• Individual tool: arcane_api_key_my_create
• Arcane route: POST /api/auth/me/api-keys
• Operation ID: create-my-api-key
• Usage: Creates a personal key owned by the caller that inherits the caller’s role permissions (no permissions list). The secret is returned only once. Arcane accepts this only from a logged-in session: it needs ARCANE_USERNAME and ARCANE_PASSWORD, never works through an API key.
• Related actions: api_key.my_list, api_key.create

api_key.my_delete

Delete my API key

Delete one of the current user’s own API keys

• Kind: destructive — requires confirm: true
• Required parameters: id
• Meta tool: arcane_api_key with "action": "my_delete"
• Individual tool: arcane_api_key_my_delete
• Arcane route: DELETE /api/auth/me/api-keys/{id}
• Operation ID: delete-my-api-key
• Usage: Deletes one of the caller’s own keys (IDs from api_key.my_list), session-only like api_key.my_create. api_key.delete removes any key with the apikeys:delete permission.
• Related actions: api_key.my_list, api_key.delete

api_key.my_list

List my API keys

List API keys owned by the current user

• Kind: read
• Required parameters: none
• Meta tool: arcane_api_key with "action": "my_list"
• Individual tool: arcane_api_key_my_list
• Arcane route: GET /api/auth/me/api-keys
• Operation ID: list-my-api-keys
• Usage: Only the keys the caller owns. Any signed-in user may call it. api_key.list shows every key of the instance.
• Related actions: api_key.my_create, api_key.my_delete, api_key.list

api_key.update

Update an API key

Update an existing API key’s details

• Kind: write
• Required parameters: id
• Meta tool: arcane_api_key with "action": "update"
• Individual tool: arcane_api_key_update
• Arcane route: PUT /api/api-keys/{id}
• Operation ID: update-api-key
• Usage: Changes name, description or expiry, or replaces the whole permissions list (omit permissions to keep them). Grants cannot exceed your own nor the owner’s role permissions (403). Personal keys reject a permissions list (400), and static or environment-pairing keys (isStatic/isBootstrap in api_key.get) cannot be updated at all (403). Changes reach clients using the key within seconds.
• Related actions: api_key.get, role.permissions