API Keys SDK Reference

API Keys

List API Keys

Returns API keys visible to the current workspace as a JSON array sorted by name. Raw tokens are never included; the token field contains a masked display value.

from orq_ai_sdk import Orq
import os

with Orq(
    api_key=os.getenv("ORQ_API_KEY", ""),
) as orq:

    res = orq.api_keys.list()

    # Handle response
    print(res)

import { Orq } from "@orq-ai/node";

const orq = new Orq({
  apiKey: process.env["ORQ_API_KEY"] ?? "",
});

async function run() {
  const result = await orq.apiKeys.list();

  console.log(result);
}

run();

Show Parameters

{
    "project_id": Optional[str],
    "source": Optional[Literal["workspace", "router"]],
}

{
  projectId?: string;
  source?: "workspace" | "router";
}

Create an API Key

Mints an opaque sk-orq- API key. Use project_scope to bind it to a single project and permission_mode with access to restrict permissions. A management key with API-key write access can create keys. The legacy projects field is also accepted. The raw token is returned once in the token field and is never retrievable afterwards. Unknown body fields are rejected.

from orq_ai_sdk import Orq
import os

with Orq(
    api_key=os.getenv("ORQ_API_KEY", ""),
) as orq:

    res = orq.api_keys.create(name="<value>")

    # Handle response
    print(res)

import { Orq } from "@orq-ai/node";

const orq = new Orq({
  apiKey: process.env["ORQ_API_KEY"] ?? "",
});

async function run() {
  const result = await orq.apiKeys.create({
    name: "<value>",
  });

  console.log(result);
}

run();

Show Parameters

{
    "name": str,  # required
    "access": Dict[str, str],  # optional
    "constraints": {  # optional
        "expires_at": str,  # optional
    },
    "expiration": str,  # optional
    "owner": {  # optional
        "type": str,  # required
        "user_id": Optional[str],
    },
    "permission_mode": Optional[Literal["all", "restricted", "read_only", "PERMISSION_MODE_ALL", "PERMISSION_MODE_RESTRICTED", "PERMISSION_MODE_READ_ONLY"]],
    "project_scope": {  # optional
        "all": Dict[str, Any],  # optional
        "mode": Optional[Literal["all", "single", "PROJECT_SCOPE_MODE_ALL", "PROJECT_SCOPE_MODE_SINGLE"]],
        "project_id": Optional[str],
        "single": {  # optional
            "project_id": str,  # required
        },
    },
    "projects": List[str],  # optional
}

{
  access?: Record<string, string>;
  constraints?: {
    expiresAt?: Date;
  };
  expiration?: Date;
  name: string;  // required
  owner?: {
    type: string;  // required
    userId?: string;
  };
  permissionMode?: "all" | "restricted" | "read_only" | "PERMISSION_MODE_ALL" | "PERMISSION_MODE_RESTRICTED" | "PERMISSION_MODE_READ_ONLY";
  projectScope?: {
    all?: Record<string, unknown>;
    mode?: "all" | "single" | "PROJECT_SCOPE_MODE_ALL" | "PROJECT_SCOPE_MODE_SINGLE";
    projectId?: string;
    single?: {
      projectId: string;  // required
    };
  };
  projects?: string[];
}

Show Response

{
    "id": str,
    "name": str,
    "workspace_id": str,
    "token": str,
    "active": Optional[bool],
    "is_legacy": Optional[bool],
    "source": Optional[str],
    "budget": Dict[str, Any],  # optional
    "expiration": str,  # optional
    "projects": List[str],  # optional
    "created_by_id": Optional[str],
    "updated_by_id": Optional[str],
    "created": str,  # optional
    "updated": str,  # optional
    "consumption": Optional[float],
    "token_consumption": Optional[float],
    "requests_per_minute_consumption": Optional[float],
    "owner": Dict[str, Any],  # optional
    "project_scope": Dict[str, Any],  # optional
    "permission_mode": Optional[str],
    "access": Dict[str, str],  # optional
    "token_prefix": Optional[str],
    "status": Optional[str],
    "constraints": Dict[str, Any],  # optional
    "mcp_access": Dict[str, Any],  # optional
    "legacy_token_family": Optional[str],
    "legacy_key_id": Optional[str],
    "last_used_at": str,  # optional
}

{
  id: string;
  name: string;
  workspaceId: string;
  token: string;
  active?: boolean;
  isLegacy?: boolean;
  source?: string;
  budget?: Record<string, any>;
  expiration?: Date;
  projects?: string[];
  createdById?: string;
  updatedById?: string;
  created?: Date;
  updated?: Date;
  consumption?: number;
  tokenConsumption?: number;
  requestsPerMinuteConsumption?: number;
  owner?: Record<string, any>;
  projectScope?: Record<string, any>;
  permissionMode?: string;
  access?: Record<string, string>;
  tokenPrefix?: string;
  status?: string;
  constraints?: Record<string, any>;
  mcpAccess?: Record<string, any>;
  legacyTokenFamily?: string;
  legacyKeyId?: string;
  lastUsedAt?: Date;
}

List Capabilities

Returns the capability catalog: the set of permission domains that can be granted to an API key. Each entry includes the domain id, display name, group, allowed project scopes and whether it can be granted read or write access. No credentials are required.

from orq_ai_sdk import Orq
import os

with Orq(
    api_key=os.getenv("ORQ_API_KEY", ""),
) as orq:

    res = orq.api_keys.list_capabilities()

    # Handle response
    print(res)

import { Orq } from "@orq-ai/node";

const orq = new Orq({
  apiKey: process.env["ORQ_API_KEY"] ?? "",
});

async function run() {
  const result = await orq.apiKeys.listCapabilities();

  console.log(result);
}

run();

Show Response

{
    "domains": [{
        "allowed_scopes": List[str],
        "display_name": str,
        "extra_write_verbs": List[str],
        "group": Literal["DOMAIN_GROUP_UNSPECIFIED", "DOMAIN_GROUP_WORKSPACE_ADMIN", "DOMAIN_GROUP_PLATFORM", "DOMAIN_GROUP_GATEWAY"],
        "id": str,
        "readable": bool,
        "writable": bool,
    }],
}

{
  domains: {
    allowedScopes: string[];
    displayName: string;
    extraWriteVerbs: string[];
    group: "DOMAIN_GROUP_UNSPECIFIED" | "DOMAIN_GROUP_WORKSPACE_ADMIN" | "DOMAIN_GROUP_PLATFORM" | "DOMAIN_GROUP_GATEWAY";
    id: string;
    readable: boolean;
    writable: boolean;
  }[];
}

Delete an API Key

Permanently deletes an API key. The key is revoked immediately; in-flight requests using it will fail. The response body is empty on success.

from orq_ai_sdk import Orq
import os

with Orq(
    api_key=os.getenv("ORQ_API_KEY", ""),
) as orq:

    orq.api_keys.delete(api_key_id="<id>")

    # Use the SDK ...

import { Orq } from "@orq-ai/node";

const orq = new Orq({
  apiKey: process.env["ORQ_API_KEY"] ?? "",
});

async function run() {
  await orq.apiKeys.delete({
    apiKeyId: "<id>",
  });

}

run();

Show Parameters

{
    "api_key_id": str,  # required
}

{
  apiKeyId: string;  // required
}

Retrieve an API Key

Retrieves the metadata for an existing API key by its unique identifier. The raw secret is never returned; token carries a masked display value.

from orq_ai_sdk import Orq
import os

with Orq(
    api_key=os.getenv("ORQ_API_KEY", ""),
) as orq:

    res = orq.api_keys.get(api_key_id="<id>")

    # Handle response
    print(res)

import { Orq } from "@orq-ai/node";

const orq = new Orq({
  apiKey: process.env["ORQ_API_KEY"] ?? "",
});

async function run() {
  const result = await orq.apiKeys.get({
    apiKeyId: "<id>",
  });

  console.log(result);
}

run();

Show Parameters

{
    "api_key_id": str,  # required
}

{
  apiKeyId: string;  // required
}

Show Response

{
    "id": str,
    "name": str,
    "workspace_id": str,
    "token": str,
    "active": Optional[bool],
    "is_legacy": Optional[bool],
    "source": Optional[str],
    "budget": Dict[str, Any],  # optional
    "expiration": str,  # optional
    "projects": List[str],  # optional
    "created_by_id": Optional[str],
    "updated_by_id": Optional[str],
    "created": str,  # optional
    "updated": str,  # optional
    "consumption": Optional[float],
    "token_consumption": Optional[float],
    "requests_per_minute_consumption": Optional[float],
    "owner": Dict[str, Any],  # optional
    "project_scope": Dict[str, Any],  # optional
    "permission_mode": Optional[str],
    "access": Dict[str, str],  # optional
    "token_prefix": Optional[str],
    "status": Optional[str],
    "constraints": Dict[str, Any],  # optional
    "mcp_access": Dict[str, Any],  # optional
    "legacy_token_family": Optional[str],
    "legacy_key_id": Optional[str],
    "last_used_at": str,  # optional
}

{
  id: string;
  name: string;
  workspaceId: string;
  token: string;
  active?: boolean;
  isLegacy?: boolean;
  source?: string;
  budget?: Record<string, any>;
  expiration?: Date;
  projects?: string[];
  createdById?: string;
  updatedById?: string;
  created?: Date;
  updated?: Date;
  consumption?: number;
  tokenConsumption?: number;
  requestsPerMinuteConsumption?: number;
  owner?: Record<string, any>;
  projectScope?: Record<string, any>;
  permissionMode?: string;
  access?: Record<string, string>;
  tokenPrefix?: string;
  status?: string;
  constraints?: Record<string, any>;
  mcpAccess?: Record<string, any>;
  legacyTokenFamily?: string;
  legacyKeyId?: string;
  lastUsedAt?: Date;
}

Update an API Key

Updates mutable fields of an API key: display name, status (active / disabled / revoked), permission mode and access map, project scope and constraints. Omitted fields keep their current values. Unknown body fields are rejected.

from orq_ai_sdk import Orq
import os

with Orq(
    api_key=os.getenv("ORQ_API_KEY", ""),
) as orq:

    res = orq.api_keys.update(api_key_id="<value>", active=False)

    # Handle response
    print(res)

import { Orq } from "@orq-ai/node";

const orq = new Orq({
  apiKey: process.env["ORQ_API_KEY"] ?? "",
});

async function run() {
  const result = await orq.apiKeys.update({
    apiKeyId: "<id>",
    requestBody: {
      active: false,
    },
  });

  console.log(result);
}

run();

Show Parameters

{
    "api_key_id": str,  # required
    "access": Dict[str, str],  # optional
    "active": Optional[bool],
    "constraints": {  # optional
        "expires_at": str,  # optional
    },
    "name": Optional[str],
    "permission_mode": Optional[Literal["all", "restricted", "read_only", "PERMISSION_MODE_ALL", "PERMISSION_MODE_RESTRICTED", "PERMISSION_MODE_READ_ONLY"]],
    "project_scope": {  # optional
        "all": Dict[str, Any],  # optional
        "mode": Optional[Literal["all", "single", "PROJECT_SCOPE_MODE_ALL", "PROJECT_SCOPE_MODE_SINGLE"]],
        "project_id": Optional[str],
        "single": {  # optional
            "project_id": str,  # required
        },
    },
    "status": Optional[Literal["active", "disabled", "revoked"]],
}

{
  apiKeyId: string;  // required
  requestBody: {  // required
    access?: Record<string, string>;
    active?: boolean;
    constraints?: {
      expiresAt?: Date;
    };
    name?: string;
    permissionMode?: "all" | "restricted" | "read_only" | "PERMISSION_MODE_ALL" | "PERMISSION_MODE_RESTRICTED" | "PERMISSION_MODE_READ_ONLY";
    projectScope?: {
      all?: Record<string, unknown>;
      mode?: "all" | "single" | "PROJECT_SCOPE_MODE_ALL" | "PROJECT_SCOPE_MODE_SINGLE";
      projectId?: string;
      single?: {
        projectId: string;  // required
      };
    };
    status?: "active" | "disabled" | "revoked";
  };
}

Show Response

{
    "id": str,
    "name": str,
    "workspace_id": str,
    "token": str,
    "active": Optional[bool],
    "is_legacy": Optional[bool],
    "source": Optional[str],
    "budget": Dict[str, Any],  # optional
    "expiration": str,  # optional
    "projects": List[str],  # optional
    "created_by_id": Optional[str],
    "updated_by_id": Optional[str],
    "created": str,  # optional
    "updated": str,  # optional
    "consumption": Optional[float],
    "token_consumption": Optional[float],
    "requests_per_minute_consumption": Optional[float],
    "owner": Dict[str, Any],  # optional
    "project_scope": Dict[str, Any],  # optional
    "permission_mode": Optional[str],
    "access": Dict[str, str],  # optional
    "token_prefix": Optional[str],
    "status": Optional[str],
    "constraints": Dict[str, Any],  # optional
    "mcp_access": Dict[str, Any],  # optional
    "legacy_token_family": Optional[str],
    "legacy_key_id": Optional[str],
    "last_used_at": str,  # optional
}

{
  id: string;
  name: string;
  workspaceId: string;
  token: string;
  active?: boolean;
  isLegacy?: boolean;
  source?: string;
  budget?: Record<string, any>;
  expiration?: Date;
  projects?: string[];
  createdById?: string;
  updatedById?: string;
  created?: Date;
  updated?: Date;
  consumption?: number;
  tokenConsumption?: number;
  requestsPerMinuteConsumption?: number;
  owner?: Record<string, any>;
  projectScope?: Record<string, any>;
  permissionMode?: string;
  access?: Record<string, string>;
  tokenPrefix?: string;
  status?: string;
  constraints?: Record<string, any>;
  mcpAccess?: Record<string, any>;
  legacyTokenFamily?: string;
  legacyKeyId?: string;
  lastUsedAt?: Date;
}

Orq SDK

Terminal & Agents

Terraform

Platform APIs

Management APIs

API Keys

List API Keys

Create an API Key

List Capabilities

Delete an API Key

Retrieve an API Key

Update an API Key

​API Keys

​List API Keys

​Create an API Key

​List Capabilities

​Delete an API Key

​Retrieve an API Key

​Update an API Key

API Keys

List API Keys

Create an API Key

List Capabilities

Delete an API Key

Retrieve an API Key

Update an API Key