Skip to Content
ReferenceAPI referenceAuth

Create an API key

POST
/api/v1/auth/api-keys

Creates a key and returns it in key. This is the only time the full key appears, so store it now. A taken name gets a 409, and a name outside 1 to 64 characters or an expiry in the past gets a 400. Send the body as application/json. API keys get a 403 here; use a browser session.

Authorization

sessionCookie
cookiesession<token>

Session cookie authentication.

Request Body

application/json
  1. body

The name, scope and expiry of a new API key.

expiresAt?|

When the key stops working, as ISO 8601 with a timezone. It must lie in the future. Omit it or send null for a key that never expires.

name*string

1 to 64 characters once surrounding whitespace is trimmed. No two keys may share a name, ignoring case.

Length1 <= length
scope?string

read allows GET and HEAD requests and the WebSocket feeds. read_write also allows writes. Defaults to read.

Default"read"
Value in"read""read_write"

Response Body

Document created, URL follows

application/json
  1. response

A new API key. This response is the only place the full key ever appears.

apiKey*

A stored API key. The key itself is never part of it.

key*string

The full key, starting with gmk_. Send it as Authorization: Bearer <key>.

Example Request
curl -X POST 'https://geometrikks.example.com/api/v1/auth/api-keys' \  -H 'Content-Type: application/json' \  -d '{  "name": "string"}'
Example Response
{  "apiKey": {    "createdAt": "2019-08-24T14:15:22Z",    "createdBy": "string",    "displayPrefix": "string",    "expired": true,    "expiresAt": "2019-08-24T14:15:22Z",    "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",    "lastUsedAt": "2019-08-24T14:15:22Z",    "lastUsedIp": "string",    "name": "string",    "scope": "read"  },  "key": "string"}

List API keys GET

Returns every key, newest first, with its scope, expiry, and when and from which IP it was last used. The key itself never appears after creation. API keys get a 403 here; use a browser session.

Revoke an API key DELETE

Deletes the key, so every request that sends it gets a 401 from then on. API keys get a 403 here; use a browser session.