# API Key routes: issue, revoke, roll

URL: /code/api/api-key/verbs · Id: `page:code/api/api-key/verbs`

> The API Key Verbs issue, revoke, roll as api.sb routes, with inputs, result, refusals and an example.

Reference for [API Key](/business/nouns/api-key), one group of [API Key routes](/code/api/api-key).

### APIKey.issue
Issue creates an API Key for one Customer and returns its secret once; afterwards only the prefix shows. [Verb page](/business/nouns/api-key/issue?interface=api).

```text
POST /{namespace}/api-keys/issue
```

Body, as JSON: the inputs. Emits [`APIKey.issued`](/business/events/APIKey.issued).

**Inputs**

| Input | Type | Required | Description |
| --- | --- | --- | --- |
| `customer` | [Customer](/business/nouns/customer) | Yes | The Customer whose calls it signs. |
| `name` | `string` | Yes | What the key is for. |
| `environment` | `string` | Yes | One of `test` or `live`. |
| `verbs` | list of [Verb](/business/nouns/verb) | No | The Verbs it may call; unset reaches every Verb the Customer’s Entitlements grant. |
| `expiresAt` | `datetime` | No | When it stops working on its own. |

**Returns**

| Output | Type | Required | Description |
| --- | --- | --- | --- |
| `apiKey` | [API Key](/business/nouns/api-key) | Yes | The API Key, with its prefix. |
| `secret` | `string` | Yes | The full secret. It is returned here once and never again. |

**Refuses when**

| Check | Error | Fix | Then call |
| --- | --- | --- | --- |
| The key is valid, but its scopes do not allow this operation. | [`forbidden`](/code/api/errors/forbidden) | Use a key whose scopes cover the operation, or ask an owner of the namespace to grant them. | None. |

**Example**

```bash
curl -X POST https://api.sb/ratebook.dev/api-keys/issue \
  -H "Authorization: Bearer $STARTUP_BUILDER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"customer":"cus_wjAFWuKWIV","name":"Nightly sync","environment":"test"}'
```

```json
{
  "api": "https://api.sb/ratebook.dev",
  "apiKey": {
    "$id": "https://api.sb/ratebook.dev/api-keys/key_BG13nfhe26",
    "$type": "APIKey",
    "name": "Nightly sync",
    "environment": "test"
  },
  "secret": "sk_live_4f2a…",
  "action": {
    "$id": "https://api.sb/ratebook.dev/actions/act_M5LgINdysq",
    "operation": "APIKey.issue",
    "status": "done"
  },
  "links": {
    "self": "https://api.sb/ratebook.dev/actions/act_M5LgINdysq"
  }
}
```

### APIKey.revoke
Revoke stops an API Key at once: its next call fails with 401, and the record and its history stay. [Verb page](/business/nouns/api-key/revoke?interface=api).

```text
POST /{namespace}/api-keys/{apiKey}/revoke
```

Path: `apiKey`. Body, as JSON: the other inputs. Emits [`APIKey.revoked`](/business/events/APIKey.revoked).

**Inputs**

| Input | Type | Required | Description |
| --- | --- | --- | --- |
| `apiKey` | [API Key](/business/nouns/api-key) | Yes | The API Key to stop. |
| `reason` | `text` | No | Why, shown to the Customer’s admins. |

**Returns**

| Output | Type | Required | Description |
| --- | --- | --- | --- |
| `apiKey` | [API Key](/business/nouns/api-key) | Yes | The API Key, with `revokedAt` set. |

**Refuses when**

| Check | Error | Fix | Then call |
| --- | --- | --- | --- |
| The key is valid, but its scopes do not allow this operation. | [`forbidden`](/code/api/errors/forbidden) | Use a key whose scopes cover the operation, or ask an owner of the namespace to grant them. | None. |

**Example**

```bash
curl -X POST https://api.sb/ratebook.dev/api-keys/key_BG13nfhe26/revoke \
  -H "Authorization: Bearer $STARTUP_BUILDER_API_KEY"
```

```json
{
  "api": "https://api.sb/ratebook.dev",
  "apiKey": {
    "$id": "https://api.sb/ratebook.dev/api-keys/key_BG13nfhe26",
    "$type": "APIKey",
    "name": "Nightly sync",
    "environment": "test"
  },
  "action": {
    "$id": "https://api.sb/ratebook.dev/actions/act_M5LgINdysq",
    "operation": "APIKey.revoke",
    "status": "done"
  },
  "links": {
    "self": "https://api.sb/ratebook.dev/actions/act_M5LgINdysq"
  }
}
```

### APIKey.roll
Roll issues a replacement API Key with the same scope and keeps the old one working until a set time. [Verb page](/business/nouns/api-key/roll?interface=api).

```text
POST /{namespace}/api-keys/{apiKey}/roll
```

Path: `apiKey`. Body, as JSON: the other inputs. Emits [`APIKey.rolled`](/business/events/APIKey.rolled).

**Inputs**

| Input | Type | Required | Description |
| --- | --- | --- | --- |
| `apiKey` | [API Key](/business/nouns/api-key) | Yes | The API Key to replace. |
| `expireIn` | `string` | No | How long the old key keeps working, from `0h` to `7d`. Defaults to `24h`. |

**Returns**

| Output | Type | Required | Description |
| --- | --- | --- | --- |
| `apiKey` | [API Key](/business/nouns/api-key) | Yes | The replacement API Key. |
| `secret` | `string` | Yes | The replacement’s full secret, returned once. |

**Refuses when**

| Check | Error | Fix | Then call |
| --- | --- | --- | --- |
| The key is valid, but its scopes do not allow this operation. | [`forbidden`](/code/api/errors/forbidden) | Use a key whose scopes cover the operation, or ask an owner of the namespace to grant them. | None. |

**Example**

```bash
curl -X POST https://api.sb/ratebook.dev/api-keys/key_BG13nfhe26/roll \
  -H "Authorization: Bearer $STARTUP_BUILDER_API_KEY"
```

```json
{
  "api": "https://api.sb/ratebook.dev",
  "apiKey": {
    "$id": "https://api.sb/ratebook.dev/api-keys/key_BG13nfhe26",
    "$type": "APIKey",
    "name": "Nightly sync",
    "environment": "test"
  },
  "secret": "sk_live_9c1e…",
  "action": {
    "$id": "https://api.sb/ratebook.dev/actions/act_M5LgINdysq",
    "operation": "APIKey.roll",
    "status": "done"
  },
  "links": {
    "self": "https://api.sb/ratebook.dev/actions/act_M5LgINdysq"
  }
}
```