API Keys: Create, Rotate, Revoke, and Delete Keys

API keys let server-side applications and ingestion pipelines authenticate with Scrubbe without user credentials. Each key is scoped to specific permissions and an environment, so you can apply the principle of least privilege to every integration. All endpoints in this section require Authorization: Bearer <accessToken> and live under /api/v1/apikey.

An API key’s secret value is shown only once immediately after creation. Store it in a secrets manager immediately — it cannot be retrieved again. If lost, rotate or delete the key and create a new one.

POST /apikey/createapikey

Create a new API key scoped to a specific environment and set of permissions.

string

required

A human-readable label for the key. Example: "Production Key".

string

required

Target environment. One of: PRODUCTION, STAGING, DEVELOPMENT.

string[]

required

Array of permission scopes granted to this key. Example: ["incidents:read", "incidents:write"].

string

ISO 8601 expiry timestamp. Omit for a non-expiring key. Example: "2026-12-31T00:00:00Z".

curl --request POST \
  --url "https://your-api-domain.com/api/v1/apikey/createapikey" \
  --header "Content-Type: application/json" \
  --header "Authorization: Bearer $ACCESS_TOKEN" \
  --data '{
    "name": "Production Key",
    "environment": "PRODUCTION",
    "scopes": ["incidents:read", "incidents:write"],
    "expiresAt": "2026-12-31T00:00:00Z"
  }'

const response = await fetch('https://your-api-domain.com/api/v1/apikey/createapikey', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Authorization': `Bearer ${accessToken}`
  },
  body: JSON.stringify({
    name: 'Production Key',
    environment: 'PRODUCTION',
    scopes: ['incidents:read', 'incidents:write'],
    expiresAt: '2026-12-31T00:00:00Z'
  })
});
const { data } = await response.json();
// Save data.key — it will not be shown again

import requests

resp = requests.post(
    "https://your-api-domain.com/api/v1/apikey/createapikey",
    headers={"Authorization": f"Bearer {access_token}"},
    json={
        "name": "Production Key",
        "environment": "PRODUCTION",
        "scopes": ["incidents:read", "incidents:write"],
        "expiresAt": "2026-12-31T00:00:00Z"
    }
)
key_secret = resp.json()["data"]["key"]  # store immediately

201 response

{
  "success": true,
  "message": "API key created successfully.",
  "data": {
    "id": "apk_01HX...",
    "name": "Production Key",
    "key": "sk_prod_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
    "environment": "PRODUCTION",
    "scopes": ["incidents:read", "incidents:write"],
    "expiresAt": "2026-12-31T00:00:00Z",
    "createdAt": "2025-06-01T09:00:00Z"
  }
}

string

The full API key secret. Shown only once — store it securely before leaving this response.

string

The key ID used for rotate, revoke, and delete operations.

GET /apikey/apikeys

List all API keys for the authenticated user’s workspace. The key secret is not included in list responses.

{
  "success": true,
  "message": "API keys retrieved.",
  "data": [
    {
      "id": "apk_01HX...",
      "name": "Production Key",
      "environment": "PRODUCTION",
      "scopes": ["incidents:read", "incidents:write"],
      "expiresAt": "2026-12-31T00:00:00Z",
      "lastUsedAt": "2025-05-20T14:22:00Z",
      "createdAt": "2025-06-01T09:00:00Z"
    }
  ]
}

POST /apikey/:id/rotate

Generate a new secret for an existing key. The old secret is immediately invalidated. The new secret is shown only in the rotation response.

string

required

The ID of the key to rotate.

{
  "success": true,
  "message": "API key rotated successfully.",
  "data": {
    "id": "apk_01HX...",
    "key": "sk_prod_yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy"
  }
}

Automate key rotation on a regular schedule (e.g., every 90 days) to limit the blast radius of a compromised credential.

POST /apikey/:id/revoke

Disable a key immediately without deleting it. The key record is retained for audit purposes but will no longer authenticate requests.

string

required

The ID of the key to revoke.

{
  "success": true,
  "message": "API key revoked successfully.",
  "data": {}
}

DELETE /apikey/:id

Permanently delete a key and its audit record. This action cannot be undone.

string

required

The ID of the key to delete.

{
  "success": true,
  "message": "API key deleted.",
  "data": {}
}

Deleting a key is irreversible. Prefer revoke if you want to retain the audit trail.

Available scopes

Scope	Description
`incidents:read`	Read incident data
`incidents:write`	Create and update incidents
`postmortems:read`	Read postmortem reports
`postmortems:write`	Create and update postmortems
`analytics:read`	Access dashboard metrics and analytics
`integrations:read`	Read integration configuration
`integrations:write`	Create and modify integrations
`ingestion:write`	Push events via ingestion endpoints

Overview

Incidents & Tickets

Intelligence

Operations

Platform

API Keys: Create, Rotate, Revoke, and Delete Keys

POST /apikey/createapikey

GET /apikey/apikeys

POST /apikey/:id/rotate

POST /apikey/:id/revoke

DELETE /apikey/:id

Available scopes

​POST /apikey/createapikey

​GET /apikey/apikeys

​POST /apikey/:id/rotate

​POST /apikey/:id/revoke

​DELETE /apikey/:id

​Available scopes

POST /apikey/createapikey

GET /apikey/apikeys

POST /apikey/:id/rotate

POST /apikey/:id/revoke

DELETE /apikey/:id

Available scopes