API keys

POST /api/v1/keys/create

Create a key. Interactive session only; API keys get 403.

GET /api/v1/keys/list

List your active keys.

Scope: keys:read (for API keys)

POST /api/v1/keys/refresh/{key_id}

Rotate a key’s secret. Interactive session and account password.

DELETE /api/v1/keys/{key_id}

Revoke a key immediately.

Scope: keys:revoke (for API keys)

Create a key

Create (from a console session)Copy

curl -X POST https://api.breachline.io/api/v1/keys/create \
  -H "Authorization: Bearer $SESSION_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name": "ci-staging", "scopes": ["llm:access", "llm:chat"], "expiresInDays": 90}'

Field	Notes
name	Required. Up to 100 characters.
type	NORMAL (default), AGENT or LLM. A label for the key’s purpose; capability comes from scopes.
scopes	Scopes to grant. Empty gives the type’s defaults. Any scope other than llm:* must be one you hold.
expiresInDays	Lifetime in days, capped at 365 by default. Omitted means the cap.
password	Your account password, required when your session is older than five minutes.

The response contains key, the plaintext key. It is returned once, with Cache-Control: no-store.

ResponseCopy

{
  "id": "4f0c...",
  "key": "bl_live_...",
  "key_prefix": "bl_live_ab12",
  "name": "ci-staging",
  "type": "NORMAL",
  "scopes": ["llm:access", "llm:chat"],
  "expires_at": "2027-02-09T12:00:00Z",
  "created_at": "2026-11-11T12:00:00Z",
  "warning": "Save this key securely. It won't be shown again!"
}

Status	Cause
400	An invalid name, or a scope that does not exist.
403	The request used an API key, or asked for scopes you do not hold.
428	Your session is older than five minutes and no password was sent.
429	You already have 10 active keys, or created 5 in the last hour.

Rotate a key

RotateCopy

curl -X POST https://api.breachline.io/api/v1/keys/refresh/$KEY_ID \
  -H "Authorization: Bearer $SESSION_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"password": "'"$ACCOUNT_PASSWORD"'"}'

The old secret stops working at once. The response is {"key": "bl_live_...", "warning": "..."}. A wrong password returns 401.

List and revoke

List, then revokeCopy

curl https://api.breachline.io/api/v1/keys/list -H "Authorization: Bearer $BREACHLINE_API_KEY"
curl -X DELETE https://api.breachline.io/api/v1/keys/$KEY_ID -H "Authorization: Bearer $BREACHLINE_API_KEY"

The list never contains plaintext keys: each entry has key_prefix, scopes, expires_at, is_active, is_expired, last_used_at and created_at.

Tip

Automate rotation from a trusted, interactive admin flow, then push the new key to your secret manager. CI jobs should only ever read keys, never create them.