ApiKey
object type
An ApiKey — the third-party / programmatic access credential. Issued ONLY by an org-group-level OWNER (the engine's LIVE ownership gate — the minting actor is a User whose Account holds group ownership); parent = the minting User. REACH DERIVES LIVE from the minter's CURRENT ownerships — the key works on exactly the group's orgs where the minter is also currently an org owner; ownership loss/re-grant is never a transition (re-grant REVIVES a not-doomed key). Descriptors ride the Roles grammar (allow/disallow, default-deny, disallow-wins), IMMUTABLE at birth; mandatory expiry ≤ 12 months (the scheduler fires active → expired — a DISTINCT doomed terminal). The secret shows ONCE at mintApiKey, hash-only at rest, and is presented only to exchangeApiKey → a 24 h-absolute no-idle API session. NOT searchable; the reads are -gated (integration config, off the floor).
Fields
| Field | Type | Notes |
|---|---|---|
id | ID ID! | The record’s id — a UUID the platform assigned when the record was created; every reference to this record uses it. |
sysId | String String! | The group-scoped human-facing system id (AK-…). |
type | String String! | The kind of record — always ApiKey here. |
caption | String String! | The record’s display name — what people see it called. |
status | String String! | The FSM state: active | expired | doomed. |
parentId | ID ID! | The parent = the MINTING User; rootId = the org group; parentId!== rootId always. |
rootId | ID ID! | The org-group family root. |
createdAt | String String! | When the record was created, as a UTC timestamp. |
updatedAt | String String! | When the record last changed, as a UTC timestamp. |
revisionNum | Int Int! | How many times this record has been edited; the first save is 0. |
revision | ID ID! | The OCC revision token — supply it on every mutation of this record; rotates on every write. |
refCaptions | RefCaption [RefCaption!]! | The server-composed captions of this record's declared references (the referenced-caption rule) — one row per referenced id; see RefCaption. |
descriptors | RoleDescriptor [RoleDescriptor!]! | The allow/disallow descriptor set — set at minting, IMMUTABLE. |
expiresAt | String String! | The mandatory expiry instant; the scheduler fires active → expired at this date. |