Keys

List this account's API keys (never returns token material)

Responses

• keys object[] (required)

Example

curl -X GET https://api.cofferline.com/v1/keys \
  -H "authorization: Bearer $TOKEN"

Create an API key (raw token returned exactly once)

Optionally pinned to a subset of wallets (#154): a wallet-scoped key reaches only classified wallet-bearing surfaces, only for its own wallets, deny-by-default. Requesting the supervisor scope mints the fleet-discipline credential (read + revocations/cancels/panic, nothing that opens exposure).

Request body

• name string
• scopes "read" | "write" | "admin" | "supervisor"[]
• expires_in_days integer
• allowed_ips string[]
• wallets string[]

Responses

• id string (required)
• token string (required)
• name string,null (required)
• scopes "read" | "write" | "admin" | "supervisor"[] (required)
• created_at object (required)
• expires_at object (required)
• allowed_ips array,null (required)
• wallets array,null (required)

Example

curl -X POST https://api.cofferline.com/v1/keys \
  -H "authorization: Bearer $TOKEN" \
  -H "content-type: application/json" \
  -d '{}'

Enroll a fleet: mint one wallet-scoped API key per agent wallet, atomically

One call, one key per agent wallet, each pinned to exactly its own wallet (deny-by-default enforcement). All keys are minted in a single transaction — a fleet is enrolled entirely or not at all. Tokens are returned exactly once.

Request body

• agents object[] (required)

Responses

• keys object[] (required)

Example

curl -X POST https://api.cofferline.com/v1/keys/enroll \
  -H "authorization: Bearer $TOKEN" \
  -H "content-type: application/json" \
  -d '{"agents":[{"wallet":"…"}]}'

Rotate API keys in batch: identical grants, fresh tokens, atomic

Replaces each named key with a new one whose scopes/wallets/IP pins are copied server-side (rotation never widens), then retires the old credential — immediately, or after overlap_seconds (never past its own prior expiry). All-or-nothing: any invalid id fails the whole batch with no changes. Tokens are returned exactly once.

Request body

• key_ids string[] (required)
• overlap_seconds integer

Responses

• rotated object[] (required)

Example

curl -X POST https://api.cofferline.com/v1/keys/rotate \
  -H "authorization: Bearer $TOKEN" \
  -H "content-type: application/json" \
  -d '{"key_ids":["…"]}'

Revoke an API key

Parameters

• id in path, string (required)

Responses

• id string (required)
• revoked true (required)

Example

curl -X DELETE https://api.cofferline.com/v1/keys/{id} \
  -H "authorization: Bearer $TOKEN"