API key endpoints
List, create and revoke a workspace's cwk_ API keys through the REST API. Admins only, and always done by a person.
Updated
Paths are relative to https://api.fishcamp.space/api/v1 and all need the X-Workspace-Id header. These are admin
actions: they must be made by a person, and requests authenticated with an API key get 403 forbidden. What keys can
do is in API keys.
List API keys
GET /workspace/api-keysAdmins. The workspace's keys with their name, scopes, when they were created and when they were last used. The keys themselves are never returned.
Create an API key
POST /workspace/api-keysAdmins.
| Field | Type | Required | Description |
|---|---|---|---|
name | string | Yes | Who or what uses the key, for example Release bot. Shown on the messages it posts. |
scopes | array | Yes | ["read"], or ["read", "write"] to also post messages and create channels. |
curl -X POST "https://api.fishcamp.space/api/v1/workspace/api-keys" \
-H "Authorization: Bearer YOUR_SESSION_TOKEN" \
-H "X-Workspace-Id: YOUR_WORKSPACE_ID" \
-H "Content-Type: application/json" \
-d '{"name": "Release bot", "scopes": ["read", "write"]}'Returns 201 Created with the new key. The full key (cwk_…) is in this response only: Fishcamp stores a hash
of it and can't show it again.
Revoke an API key
DELETE /workspace/api-keys/:keyIdAdmins. The key stops working at once: the next request made with it gets 401 unauthorized. Returns 204.