Management Keys
List Management Keys
Returns management keys in the current workspace, ordered by creation time with the newest key first. Theapi_key and token_hash fields are never returned by this endpoint; only token_prefix is included.
from orq_ai_sdk import Orq
import os
with Orq(
api_key=os.getenv("ORQ_API_KEY", ""),
) as orq:
res = orq.management_keys.list()
# Handle response
print(res)
import { Orq } from "@orq-ai/node";
const orq = new Orq({
apiKey: process.env["ORQ_API_KEY"] ?? "",
});
async function run() {
const result = await orq.managementKeys.list();
console.log(result);
}
run();
Show Parameters
Show Parameters
{
"limit": Optional[int],
"starting_after": Optional[str],
"ending_before": Optional[str],
"status": Optional[Literal["MANAGEMENT_KEY_STATUS_ACTIVE", "MANAGEMENT_KEY_STATUS_DISABLED", "MANAGEMENT_KEY_STATUS_REVOKED"]],
"search": Optional[str],
"permission_mode": List[Literal["MANAGEMENT_PERMISSION_MODE_ALL", "MANAGEMENT_PERMISSION_MODE_RESTRICTED", "MANAGEMENT_PERMISSION_MODE_READ_ONLY"]], # optional
}
{
limit?: number;
startingAfter?: string;
endingBefore?: string;
status?: "MANAGEMENT_KEY_STATUS_ACTIVE" | "MANAGEMENT_KEY_STATUS_DISABLED" | "MANAGEMENT_KEY_STATUS_REVOKED";
search?: string;
permissionMode?: ("MANAGEMENT_PERMISSION_MODE_ALL" | "MANAGEMENT_PERMISSION_MODE_RESTRICTED" | "MANAGEMENT_PERMISSION_MODE_READ_ONLY")[];
}
Show Response
Show Response
{
"object": str,
"data": [{
"management_key_id": str,
"name": str,
"permission_mode": Literal["MANAGEMENT_PERMISSION_MODE_ALL", "MANAGEMENT_PERMISSION_MODE_RESTRICTED", "MANAGEMENT_PERMISSION_MODE_READ_ONLY"],
"access": Dict[str, AccessLevel], # optional
"token_prefix": str,
"status": Literal["MANAGEMENT_KEY_STATUS_ACTIVE", "MANAGEMENT_KEY_STATUS_DISABLED", "MANAGEMENT_KEY_STATUS_REVOKED"],
"created_by_id": Optional[str],
"updated_by_id": Optional[str],
"created_at": str,
"updated_at": str,
"last_used_at": str, # optional
"expires_at": str, # optional
}],
"has_more": bool,
}
{
object: string;
data: {
managementKeyId: string;
name: string;
permissionMode: "MANAGEMENT_PERMISSION_MODE_ALL" | "MANAGEMENT_PERMISSION_MODE_RESTRICTED" | "MANAGEMENT_PERMISSION_MODE_READ_ONLY";
access?: Record<string, AccessLevel>;
tokenPrefix: string;
status: "MANAGEMENT_KEY_STATUS_ACTIVE" | "MANAGEMENT_KEY_STATUS_DISABLED" | "MANAGEMENT_KEY_STATUS_REVOKED";
createdById?: string;
updatedById?: string;
createdAt: Date;
updatedAt: Date;
lastUsedAt?: Date;
expiresAt?: Date;
}[];
hasMore: boolean;
}
Create a Management Key
Mints a new opaque management key (sk-orq-<key_id>-<secret>) in the workspace. The raw secret is returned ONCE in the response and is never retrievable afterwards. The stored record retains only token_prefix and a SHA-256 token_hash.
from orq_ai_sdk import Orq
import os
with Orq(
api_key=os.getenv("ORQ_API_KEY", ""),
) as orq:
res = orq.management_keys.create(name="<value>", permission_mode="MANAGEMENT_PERMISSION_MODE_ALL")
# Handle response
print(res)
import { Orq } from "@orq-ai/node";
const orq = new Orq({
apiKey: process.env["ORQ_API_KEY"] ?? "",
});
async function run() {
const result = await orq.managementKeys.create({
name: "<value>",
permissionMode: "MANAGEMENT_PERMISSION_MODE_ALL",
});
console.log(result);
}
run();
Show Parameters
Show Parameters
{
"name": str, # required
"permission_mode": Literal["MANAGEMENT_PERMISSION_MODE_ALL", "MANAGEMENT_PERMISSION_MODE_RESTRICTED", "MANAGEMENT_PERMISSION_MODE_READ_ONLY"], # required
"access": Dict[str, AccessLevel], # optional
"expires_at": str, # optional
}
{
name: string; // required
permissionMode: "MANAGEMENT_PERMISSION_MODE_ALL" | "MANAGEMENT_PERMISSION_MODE_RESTRICTED" | "MANAGEMENT_PERMISSION_MODE_READ_ONLY"; // required
access?: Record<string, AccessLevel>;
expiresAt?: Date;
}
Show Response
Show Response
{
"management_key": {
"management_key_id": str,
"name": str,
"permission_mode": Literal["MANAGEMENT_PERMISSION_MODE_ALL", "MANAGEMENT_PERMISSION_MODE_RESTRICTED", "MANAGEMENT_PERMISSION_MODE_READ_ONLY"],
"access": Dict[str, AccessLevel], # optional
"token_prefix": str,
"status": Literal["MANAGEMENT_KEY_STATUS_ACTIVE", "MANAGEMENT_KEY_STATUS_DISABLED", "MANAGEMENT_KEY_STATUS_REVOKED"],
"created_by_id": Optional[str],
"updated_by_id": Optional[str],
"created_at": str,
"updated_at": str,
"last_used_at": str, # optional
"expires_at": str, # optional
},
"token": str,
}
{
managementKey: {
managementKeyId: string;
name: string;
permissionMode: "MANAGEMENT_PERMISSION_MODE_ALL" | "MANAGEMENT_PERMISSION_MODE_RESTRICTED" | "MANAGEMENT_PERMISSION_MODE_READ_ONLY";
access?: Record<string, AccessLevel>;
tokenPrefix: string;
status: "MANAGEMENT_KEY_STATUS_ACTIVE" | "MANAGEMENT_KEY_STATUS_DISABLED" | "MANAGEMENT_KEY_STATUS_REVOKED";
createdById?: string;
updatedById?: string;
createdAt: Date;
updatedAt: Date;
lastUsedAt?: Date;
expiresAt?: Date;
};
token: string;
}
List Capabilities
Returns the management capability catalog: the set of workspace-admin permission domains that can be granted to a management key. Each entry includes the domain id, display name, group, and the read / write verb support. Drives the permissions UI in the dashboard.from orq_ai_sdk import Orq
import os
with Orq(
api_key=os.getenv("ORQ_API_KEY", ""),
) as orq:
res = orq.management_keys.list_capabilities()
# Handle response
print(res)
import { Orq } from "@orq-ai/node";
const orq = new Orq({
apiKey: process.env["ORQ_API_KEY"] ?? "",
});
async function run() {
const result = await orq.managementKeys.listCapabilities();
console.log(result);
}
run();
Show Response
Show Response
{
"domains": [{
"id": Optional[str],
"display_name": Optional[str],
"group": Optional[Literal["DOMAIN_GROUP_WORKSPACE_ADMIN"]],
"readable": Optional[bool],
"writable": Optional[bool],
}],
}
{
domains: {
id?: string;
displayName?: string;
group?: "DOMAIN_GROUP_WORKSPACE_ADMIN";
readable?: boolean;
writable?: boolean;
}[];
}
Retrieve a Management Key
Retrieves the metadata for an existing management key by its unique identifier. The raw secret is never returned: onlytoken_prefix, permission_mode, and lifecycle fields.
from orq_ai_sdk import Orq
import os
with Orq(
api_key=os.getenv("ORQ_API_KEY", ""),
) as orq:
res = orq.management_keys.get(management_key_id="<id>")
# Handle response
print(res)
import { Orq } from "@orq-ai/node";
const orq = new Orq({
apiKey: process.env["ORQ_API_KEY"] ?? "",
});
async function run() {
const result = await orq.managementKeys.get({
managementKeyId: "<id>",
});
console.log(result);
}
run();
Show Parameters
Show Parameters
{
"management_key_id": str, # required
}
{
managementKeyId: string; // required
}
Show Response
Show Response
{
"management_key": {
"management_key_id": str,
"name": str,
"permission_mode": Literal["MANAGEMENT_PERMISSION_MODE_ALL", "MANAGEMENT_PERMISSION_MODE_RESTRICTED", "MANAGEMENT_PERMISSION_MODE_READ_ONLY"],
"access": Dict[str, AccessLevel], # optional
"token_prefix": str,
"status": Literal["MANAGEMENT_KEY_STATUS_ACTIVE", "MANAGEMENT_KEY_STATUS_DISABLED", "MANAGEMENT_KEY_STATUS_REVOKED"],
"created_by_id": Optional[str],
"updated_by_id": Optional[str],
"created_at": str,
"updated_at": str,
"last_used_at": str, # optional
"expires_at": str, # optional
},
}
{
managementKey: {
managementKeyId: string;
name: string;
permissionMode: "MANAGEMENT_PERMISSION_MODE_ALL" | "MANAGEMENT_PERMISSION_MODE_RESTRICTED" | "MANAGEMENT_PERMISSION_MODE_READ_ONLY";
access?: Record<string, AccessLevel>;
tokenPrefix: string;
status: "MANAGEMENT_KEY_STATUS_ACTIVE" | "MANAGEMENT_KEY_STATUS_DISABLED" | "MANAGEMENT_KEY_STATUS_REVOKED";
createdById?: string;
updatedById?: string;
createdAt: Date;
updatedAt: Date;
lastUsedAt?: Date;
expiresAt?: Date;
};
}
Delete a Management Key
Permanently deletes a management key. Cache entries are invalidated immediately so an in-flight token cannot ride out the TTL. The response body is empty on success.from orq_ai_sdk import Orq
import os
with Orq(
api_key=os.getenv("ORQ_API_KEY", ""),
) as orq:
res = orq.management_keys.delete(management_key_id="<id>")
# Handle response
print(res)
import { Orq } from "@orq-ai/node";
const orq = new Orq({
apiKey: process.env["ORQ_API_KEY"] ?? "",
});
async function run() {
const result = await orq.managementKeys.delete({
managementKeyId: "<id>",
});
console.log(result);
}
run();
Show Parameters
Show Parameters
{
"management_key_id": str, # required
}
{
managementKeyId: string; // required
}
Update a Management Key
Updates mutable fields of a management key: display name, status (active / disabled / revoked), permission mode and access map, and expiry. Omitted fields keep their current values.from orq_ai_sdk import Orq
import os
with Orq(
api_key=os.getenv("ORQ_API_KEY", ""),
) as orq:
res = orq.management_keys.update(management_key_id="<id>", name="<value>")
# Handle response
print(res)
import { Orq } from "@orq-ai/node";
const orq = new Orq({
apiKey: process.env["ORQ_API_KEY"] ?? "",
});
async function run() {
const result = await orq.managementKeys.update({
managementKeyId: "<id>",
updateManagementKeyRequest: {
name: "<value>",
},
});
console.log(result);
}
run();
Show Parameters
Show Parameters
{
"management_key_id": str, # required
"name": Optional[str],
"status": Optional[Literal["MANAGEMENT_KEY_STATUS_ACTIVE", "MANAGEMENT_KEY_STATUS_DISABLED", "MANAGEMENT_KEY_STATUS_REVOKED"]],
"permission_mode": Optional[Literal["MANAGEMENT_PERMISSION_MODE_ALL", "MANAGEMENT_PERMISSION_MODE_RESTRICTED", "MANAGEMENT_PERMISSION_MODE_READ_ONLY"]],
"access": Dict[str, AccessLevel], # optional
"expires_at": str, # optional
"clear_expires_at": Optional[bool],
}
{
managementKeyId: string; // required
updateManagementKeyRequest: { // required
name?: string;
status?: "MANAGEMENT_KEY_STATUS_ACTIVE" | "MANAGEMENT_KEY_STATUS_DISABLED" | "MANAGEMENT_KEY_STATUS_REVOKED";
permissionMode?: "MANAGEMENT_PERMISSION_MODE_ALL" | "MANAGEMENT_PERMISSION_MODE_RESTRICTED" | "MANAGEMENT_PERMISSION_MODE_READ_ONLY";
access?: Record<string, AccessLevel>;
expiresAt?: Date;
clearExpiresAt?: boolean;
};
}
Show Response
Show Response
{
"management_key": {
"management_key_id": str,
"name": str,
"permission_mode": Literal["MANAGEMENT_PERMISSION_MODE_ALL", "MANAGEMENT_PERMISSION_MODE_RESTRICTED", "MANAGEMENT_PERMISSION_MODE_READ_ONLY"],
"access": Dict[str, AccessLevel], # optional
"token_prefix": str,
"status": Literal["MANAGEMENT_KEY_STATUS_ACTIVE", "MANAGEMENT_KEY_STATUS_DISABLED", "MANAGEMENT_KEY_STATUS_REVOKED"],
"created_by_id": Optional[str],
"updated_by_id": Optional[str],
"created_at": str,
"updated_at": str,
"last_used_at": str, # optional
"expires_at": str, # optional
},
}
{
managementKey: {
managementKeyId: string;
name: string;
permissionMode: "MANAGEMENT_PERMISSION_MODE_ALL" | "MANAGEMENT_PERMISSION_MODE_RESTRICTED" | "MANAGEMENT_PERMISSION_MODE_READ_ONLY";
access?: Record<string, AccessLevel>;
tokenPrefix: string;
status: "MANAGEMENT_KEY_STATUS_ACTIVE" | "MANAGEMENT_KEY_STATUS_DISABLED" | "MANAGEMENT_KEY_STATUS_REVOKED";
createdById?: string;
updatedById?: string;
createdAt: Date;
updatedAt: Date;
lastUsedAt?: Date;
expiresAt?: Date;
};
}