aethexDocs
Dashboard

API Reference

API Keys API

Manage the API keys your application uses to call Aethex.Customer-callable surface. Only GET /api-keys (list) and POST /api-keys/{key_id}/rotate are callable with a customer API key. Creation (POST /api-keys) and revocation (DELETE /api-keys/{key_id}) are admin-gated on the public router and return 403 Invalid admin secret for customer callers; create and revoke keys in the developer portal UI instead, which calls the JWT-gated portal mirror routes at /api/v1/dashboard/api-keys.Authentication. Send your existing API key as X-API-Key: ae_live_… (or Authorization: Bearer ae_live_…). The list and rotate routes do not require any extra scope, but rotating returns the new key value exactly once — store it before the response goes out of scope.

Base URL
https://api.aethexai.com/api/v1
Endpoints
2
GET/api-keys

Return every API key on your tenant. Response is a bare JSON array (not paginated).

List API Keys

Returns every active and revoked API key the authenticating tenant owns, newest first. The response is a bare JSON array — there is no envelope and no pagination — so plan for the whole list on every call. Cache the result on your side; tenants with many keys will pay O(keys) on every fetch.The key field is always null on this endpoint; the raw secret is only ever returned on creation or rotation. key_prefix (the first 12 characters of the original key, e.g. ae_live_ebc5) is what lets you correlate a row here with a key stored in your secret manager.

Errors

1
401Unauthorized

Missing or invalid API key.

Send X-API-Key: '<'api_key'>' or Authorization: Bearer '<'api_key'>'.

POST/api-keys/:key_id/rotate

Mint a new secret for an existing key id. Old secret keeps working for a 24-hour grace period by default.

Rotate an API Key

Issues a new secret for an existing key id while preserving its scopes, rate limits, and name. The plaintext key is returned in the key field exactly once — store it immediately.The old secret keeps working for a 24-hour grace period (old_key_expires_at carries the expiry); during that window both secrets authenticate so callers can roll out the new value without downtime. Pass ?revoke_immediately=true to hard-revoke the old secret in the same call (use for suspected compromise) — old_key_expires_at is null in that case.This route is callable with the API key you are rotating or with any other key on the same tenant.

Path & Query

2
  • key_idstring (uuid)required

    ID of the API key to rotate. Use the id field from GET /api-keys, not the key_prefix.

  • revoke_immediatelybooleanoptional

    When false (default), the old key keeps working for a 24-hour grace period; the grace expiry is returned as old_key_expires_at. Set to true to hard-revoke the old key in the same call.

Errors

2
401Unauthorized

Missing or invalid API key.

Send X-API-Key: '<'api_key'>' or Authorization: Bearer '<'api_key'>'.

404Key not found

No API key with the supplied key_id exists on your tenant. Either the id is wrong, or the key was already revoked and pruned.

Confirm the id by listing keys at GET /api-keys and re-issue the rotation.