InternetDataInternetData

Reveal

POST
/api/v1/iam/apikeys/{id}/reveal

Returns an existing key's secret.

Its own scope rather than part of apikeys.manage, because the two are different acts: rotating replaces a secret you never see, while this hands one over.

Refused with NOT_RETRIEVABLE for a key issued before this product stored secrets recoverably - that secret was never kept, so no retry will ever produce it. Rotate the key instead.

Authorization

BearerAuth apikeys.reveal
AuthorizationBearer <token>

Authorization: Bearer <key>, with a key from the console. Keys are default-deny: each operation names the scope it needs, and an existing key does not gain an operation until that scope is added to it.

In: header

Scope: apikeys.reveal

Path Parameters

id*string

The key's id, as returned by the list endpoint. Never the key itself.

Formatuuid

Response Body

application/json

application/json

application/json

application/json

curl -X POST "https://internetdata.io/api/v1/iam/apikeys/497f6eca-6276-4993-bfeb-53cbbbba6f08/reveal"
{
  "rc": "string",
  "key": "string"
}
{
  "rc": "string"
}
{
  "rc": "string"
}
{
  "rc": "string"
}

Revoke POST

Stops the key working. Revocation is soft: the key stays listed with a `revoked_at`, because the organization still owns whatever it did while it was alive.

Discovery GET

RFC 8414 authorization server metadata: the endpoints, the grant types and the scopes this server supports. Read this rather than hardcoding endpoints. It is also served at `/.well-known/openid-configuration`, identically, because several clients probe that path first.