IssuedApiKeyResponseDto

idstringrequired

namestringrequired

descriptionobjectnullablerequired

environmentstringrequired

Possible values: [live, test]

scopeTargetstringrequired

Possible values: [tenant, platform]

keyPrefixstringrequired

Example: mt_live_a1b2c3

keyLast4stringrequired

signingSecretLast4stringrequired

requireSignaturebooleanrequired

scopesstring[]required

Possible values: [operations.read, operations.write, operations.delete, workforce.read, workforce.write, workforce.delete, inventory.read, inventory.write, inventory.delete, compliance.read, compliance.write, compliance.delete, safety.read, safety.write, safety.delete, incidents.read, incidents.write, incidents.delete, environment.read, environment.write, environment.delete, finance.read, finance.write, finance.delete, disbursements.read, disbursements.write, disbursements.delete, reporting.read, reporting.write, reporting.delete, dashboards.read, dashboards.write, dashboards.delete, users.read, users.write, users.delete, roles.read, roles.write, roles.delete, permissions.read, permissions.write, permissions.delete, tenant_config.read, tenant_config.write, tenant_config.delete, audit.read, audit.write, audit.delete, notifications.read, notifications.write, notifications.delete, files.read, files.write, files.delete, sync.read, sync.write, sync.delete, platform.read, platform.write, platform.delete]

ipAllowliststring[]required

rateLimitPerMinutenumberrequired

expiresAtobjectnullablerequired

lastUsedAtobjectnullablerequired

revokedAtobjectnullablerequired

revokedReasonobjectnullablerequired

createdAtstringrequired

plaintextKeystringrequired

The full API key. Shown exactly once — it is stored only as a bcrypt hash and cannot be recovered.

signingSecretstringrequired

HMAC signing secret. Shown exactly once. Used to compute x-mt-signature.

IssuedApiKeyResponseDto

{
  "id": "string",
  "name": "string",
  "description": {},
  "environment": "live",
  "scopeTarget": "tenant",
  "keyPrefix": "mt_live_a1b2c3",
  "keyLast4": "string",
  "signingSecretLast4": "string",
  "requireSignature": true,
  "scopes": [
    "operations.read"
  ],
  "ipAllowlist": [
    "string"
  ],
  "rateLimitPerMinute": 0,
  "expiresAt": {},
  "lastUsedAt": {},
  "revokedAt": {},
  "revokedReason": {},
  "createdAt": "string",
  "plaintextKey": "string",
  "signingSecret": "string"
}