Skip to main content
POST
JavaScript
The global key is system-managed and refuses deletion, so this is its off switch. While disabled, its token fails authentication on every endpoint in every workspace; the key itself stays, ready for enable.
Idempotent: a second disable returns 200 and changes nothing.
Do not make this call with the global key’s own token unless a different credential can make the enable call after it. Disabling the token you are using locks that credential out mid-incident; a workspace key with account:manage is the safe seat to do this from.

Enable the global key

Turn it back on.

Rotate the global key

Replace the token instead of reviving it.

Authorizations

Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Response

OK

An API key. Every key belongs to exactly one workspace and is managed via the workspace-scoped API key routes. The only exception is the system-managed global account key, which spans all workspaces and is managed via the account global_api_key routes.

metadata
object
required

AccountResourceMetadata is used to represent a resource that is associated to an account but not to a workspace.

spec
object
required

Configuration for an API key.

state
enum<string>
required
read-only

The current lifecycle state of the API key. Output only. Keys are created STATE_ENABLED; use the :disable and :enable actions to transition between states.

Available options:
STATE_UNSPECIFIED,
STATE_ENABLED,
STATE_DISABLED
info
object