GetItDoneGetItDone Docs
API ReferenceA P I keys

Create an API key

Mints a new org-owned API key. Beyond the `api-keys:manage` scope check, the CALLING credential's creator must currently hold an owner/admin membership in the organization — a key minted while its creator was an admin stops being able to mint further keys the moment that user is demoted (403 `insufficient_scope`). Supports the optional `Idempotency-Key` header; note the replay caution: a replayed response includes the ORIGINAL plaintext `key` again within the 24h replay window (the same tradeoff Stripe makes for idempotent secret-bearing responses) — treat a stored Idempotency-Key as equally sensitive to the secret itself.

POST
/v1/api-keys

Mints a new org-owned API key. Beyond the api-keys:manage scope check, the CALLING credential's creator must currently hold an owner/admin membership in the organization — a key minted while its creator was an admin stops being able to mint further keys the moment that user is demoted (403 insufficient_scope). Supports the optional Idempotency-Key header; note the replay caution: a replayed response includes the ORIGINAL plaintext key again within the 24h replay window (the same tradeoff Stripe makes for idempotent secret-bearing responses) — treat a stored Idempotency-Key as equally sensitive to the secret itself.

Authorization

bearerAuth
AuthorizationBearer <token>

A gid_ API key (Settings → API keys) or an OAuth 2.1 access token.

In: header

Header Parameters

Idempotency-Key?string

Optional client-generated key (1-255 visible ASCII characters; a UUID works) making this POST safely retryable. Retrying with the SAME key and byte-identical body within 24h replays the stored first response (marked Idempotency-Replayed: true, never re-executed, never charged against quota). The same key with a different body answers 422 idempotency_key_reused; a retry racing the first execution answers 409 idempotency_in_progress. Omitting the header executes normally with no idempotency guarantee.

Length1 <= length <= 255

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Fields for minting a new API key.

Response Body

application/json

application/problem+json

application/problem+json

application/problem+json

application/problem+json

application/problem+json

application/problem+json

application/problem+json

curl -X POST "https://example.com/v1/api-keys" \  -H "Content-Type: application/json" \  -d '{    "name": "string"  }'
{  "id": "string",  "name": "string",  "key_prefix": "string",  "scopes": [    "workspaces:read"  ],  "last_used_at": "2019-08-24T14:15:22Z",  "expires_at": "2019-08-24T14:15:22Z",  "created_at": "2019-08-24T14:15:22Z",  "legacy": true,  "key": "string"}

List API keys GET

Cursor-paginated list of the organization's API keys (both generations), metadata only — never hashes or plaintext secrets.

Revoke an API key DELETE

Revokes an API key (either generation) — org-scoped; an id from another organization or an unknown id answers 404 `resource_not_found` (no cross-org existence oracle). A key revoking ITSELF is allowed: the credential is only checked at the top of the request, before the revoke runs. DELETE is naturally idempotent by HTTP semantics — this route does not use the Idempotency-Key ledger.