> For the complete documentation index, see [llms.txt](https://docs.otari.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.otari.ai/otari/for-integrators/api-reference/organization-keys.md).

# Organization keys

## List Own Keys

> List the caller's own API keys in their active organization, newest first.\
> \
> Only keys billed to the caller's own user: an operator-minted key assigned\
> to them is theirs to see here, and nobody else's key ever is. Naming a\
> workspace outside their organization lists nothing rather than refusing, so\
> the filter reports no more than the unfiltered read does.

```json
{"openapi":"3.1.0","info":{"title":"otari","version":"0.33.0"},"security":[{"ApiKeyAuth":[]},{"XApiKeyAuth":[]}],"components":{"securitySchemes":{"ApiKeyAuth":{"description":"Enter your API key here (sent as Otari-Key header).","in":"header","name":"Otari-Key","type":"apiKey"},"XApiKeyAuth":{"description":"Anthropic-native clients send credentials here (no Bearer prefix).","in":"header","name":"x-api-key","type":"apiKey"}},"schemas":{"KeyInfo":{"description":"Response model for key information.","properties":{"allowed_models":{"anyOf":[{"items":{"type":"string"},"type":"array"},{"type":"null"}],"title":"Allowed Models"},"allowed_tools":{"anyOf":[{"items":{"type":"string"},"type":"array"},{"type":"null"}],"title":"Allowed Tools"},"capture_agent_telemetry":{"anyOf":[{"type":"boolean"},{"type":"null"}],"title":"Capture Agent Telemetry"},"config_name":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Config Name"},"created_at":{"title":"Created At","type":"string"},"end_user_budget_id":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"End User Budget Id"},"end_user_budget_ids":{"items":{"type":"string"},"title":"End User Budget Ids","type":"array"},"exclude_from_budget":{"title":"Exclude From Budget","type":"boolean"},"expires_at":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Expires At"},"id":{"title":"Id","type":"string"},"is_active":{"title":"Is Active","type":"boolean"},"is_service_key":{"title":"Is Service Key","type":"boolean"},"key_name":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Key Name"},"key_prefix":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Key Prefix"},"key_suffix":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Key Suffix"},"last_used_at":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Last Used At"},"max_end_users":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Max End Users"},"metadata":{"additionalProperties":true,"title":"Metadata","type":"object"},"operator_disabled":{"default":false,"title":"Operator Disabled","type":"boolean"},"reject_user_mismatch":{"anyOf":[{"type":"boolean"},{"type":"null"}],"title":"Reject User Mismatch"},"user_id":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"User Id"},"workspace_id":{"format":"uuid","title":"Workspace Id","type":"string"}},"required":["id","key_prefix","key_suffix","key_name","user_id","created_at","last_used_at","expires_at","is_active","allowed_models","allowed_tools","exclude_from_budget","reject_user_mismatch","capture_agent_telemetry","is_service_key","end_user_budget_id","end_user_budget_ids","workspace_id","metadata"],"title":"KeyInfo","type":"object"},"HTTPValidationError":{"properties":{"code":{"const":"invalid_request","description":"Stable error code, also sent as the Otari-Error-Code header.","title":"Code","type":"string"},"detail":{"items":{"$ref":"#/components/schemas/ValidationError"},"title":"Detail","type":"array"}},"title":"HTTPValidationError","type":"object"},"ValidationError":{"properties":{"ctx":{"title":"Context","type":"object"},"input":{"title":"Input"},"loc":{"items":{"anyOf":[{"type":"string"},{"type":"integer"}]},"title":"Location","type":"array"},"msg":{"title":"Message","type":"string"},"type":{"title":"Error Type","type":"string"}},"required":["loc","msg","type"],"title":"ValidationError","type":"object"}}},"paths":{"/api/v1/organizations/me/keys":{"get":{"description":"List the caller's own API keys in their active organization, newest first.\n\nOnly keys billed to the caller's own user: an operator-minted key assigned\nto them is theirs to see here, and nobody else's key ever is. Naming a\nworkspace outside their organization lists nothing rather than refusing, so\nthe filter reports no more than the unfiltered read does.","operationId":"organization-keys-list_own_keys","parameters":[{"in":"query","name":"skip","required":false,"schema":{"default":0,"minimum":0,"title":"Skip","type":"integer"}},{"in":"query","name":"limit","required":false,"schema":{"default":100,"maximum":1000,"minimum":1,"title":"Limit","type":"integer"}},{"description":"Only keys in this workspace.","in":"query","name":"workspace_id","required":false,"schema":{"anyOf":[{"format":"uuid","type":"string"},{"type":"null"}],"description":"Only keys in this workspace.","title":"Workspace Id"}}],"responses":{"200":{"content":{"application/json":{"schema":{"items":{"$ref":"#/components/schemas/KeyInfo"},"title":"Response Organization-Keys-List Own Keys","type":"array"}}},"description":"Successful Response"},"422":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}},"description":"Validation Error"}},"summary":"List Own Keys","tags":["organization-keys"]}}}}
```

## Create Own Key

> Create an API key owned by the caller, in a workspace they may see.\
> \
> The member-scoped counterpart of \`\`POST /api/v1/keys\`\`: the owner is always the\
> caller's own attribution user, the key is always budget-enforced, and the\
> workspace must be visible to the caller (a member of it, or an organization\
> owner/admin, who see every workspace). A viewer of the workspace is refused\
> with 403. The secret is returned once.

```json
{"openapi":"3.1.0","info":{"title":"otari","version":"0.33.0"},"security":[{"ApiKeyAuth":[]},{"XApiKeyAuth":[]}],"components":{"securitySchemes":{"ApiKeyAuth":{"description":"Enter your API key here (sent as Otari-Key header).","in":"header","name":"Otari-Key","type":"apiKey"},"XApiKeyAuth":{"description":"Anthropic-native clients send credentials here (no Bearer prefix).","in":"header","name":"x-api-key","type":"apiKey"}},"schemas":{"CreateOwnKeyRequest":{"description":"Create-key body for the member surface.\n\nDeliberately not ``CreateKeyRequest``: it carries no ``user_id`` (the owner\nis always the caller) and no ``exclude_from_budget`` (a member must not\nexempt their own spend from enforcement).","properties":{"allowed_models":{"anyOf":[{"items":{"type":"string"},"type":"array"},{"type":"null"}],"description":"Model allow-list: null = any model your user default allows, [] = deny all, or canonical instance:model entries. A key can only narrow your own model access, never broaden it.","title":"Allowed Models"},"allowed_tools":{"anyOf":[{"items":{"type":"string"},"type":"array"},{"type":"null"}],"description":"Search tool allow-list for POST /api/v1/search: null = inherit your own, [] = no tool, or search tool names ('*' for every search tool). A key can only narrow your own tool access.","title":"Allowed Tools"},"capture_agent_telemetry":{"anyOf":[{"type":"boolean"},{"type":"null"}],"description":"Per-key override of the deployment-wide capture_agent_telemetry setting: null (default) inherits it, true always stores this key's coding-agent telemetry, false always discards it.","title":"Capture Agent Telemetry"},"expires_at":{"anyOf":[{"format":"date-time","type":"string"},{"type":"null"}],"description":"Optional expiration timestamp","title":"Expires At"},"key_name":{"anyOf":[{"type":"string"},{"type":"null"}],"description":"Optional name for the key","title":"Key Name"},"metadata":{"additionalProperties":true,"description":"Optional metadata","title":"Metadata","type":"object"},"reject_user_mismatch":{"anyOf":[{"type":"boolean"},{"type":"null"}],"description":"Per-key override of the deployment-wide reject_user_mismatch setting: null (default) inherits it, true always rejects a request naming a different 'user', false always accepts it. Spend binds to your own user either way.","title":"Reject User Mismatch"},"workspace_id":{"anyOf":[{"format":"uuid","type":"string"},{"type":"null"}],"description":"Workspace this key belongs to, which must be one you may see in your active organization. Omitted means that organization's default workspace, refused when you are not a member of it.","title":"Workspace Id"}},"title":"CreateOwnKeyRequest","type":"object"},"CreateKeyResponse":{"description":"Response model for creating a new API key.","properties":{"allowed_models":{"anyOf":[{"items":{"type":"string"},"type":"array"},{"type":"null"}],"title":"Allowed Models"},"allowed_tools":{"anyOf":[{"items":{"type":"string"},"type":"array"},{"type":"null"}],"title":"Allowed Tools"},"capture_agent_telemetry":{"anyOf":[{"type":"boolean"},{"type":"null"}],"title":"Capture Agent Telemetry"},"created_at":{"title":"Created At","type":"string"},"end_user_budget_id":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"End User Budget Id"},"end_user_budget_ids":{"items":{"type":"string"},"title":"End User Budget Ids","type":"array"},"exclude_from_budget":{"title":"Exclude From Budget","type":"boolean"},"expires_at":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Expires At"},"id":{"title":"Id","type":"string"},"is_active":{"title":"Is Active","type":"boolean"},"is_service_key":{"title":"Is Service Key","type":"boolean"},"key":{"title":"Key","type":"string"},"key_name":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Key Name"},"key_prefix":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Key Prefix"},"key_suffix":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Key Suffix"},"max_end_users":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Max End Users"},"metadata":{"additionalProperties":true,"title":"Metadata","type":"object"},"reject_user_mismatch":{"anyOf":[{"type":"boolean"},{"type":"null"}],"title":"Reject User Mismatch"},"user_id":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"User Id"}},"required":["id","key","key_prefix","key_suffix","key_name","user_id","created_at","expires_at","is_active","allowed_models","allowed_tools","exclude_from_budget","reject_user_mismatch","capture_agent_telemetry","is_service_key","end_user_budget_id","end_user_budget_ids","max_end_users","metadata"],"title":"CreateKeyResponse","type":"object"},"HTTPValidationError":{"properties":{"code":{"const":"invalid_request","description":"Stable error code, also sent as the Otari-Error-Code header.","title":"Code","type":"string"},"detail":{"items":{"$ref":"#/components/schemas/ValidationError"},"title":"Detail","type":"array"}},"title":"HTTPValidationError","type":"object"},"ValidationError":{"properties":{"ctx":{"title":"Context","type":"object"},"input":{"title":"Input"},"loc":{"items":{"anyOf":[{"type":"string"},{"type":"integer"}]},"title":"Location","type":"array"},"msg":{"title":"Message","type":"string"},"type":{"title":"Error Type","type":"string"}},"required":["loc","msg","type"],"title":"ValidationError","type":"object"}}},"paths":{"/api/v1/organizations/me/keys":{"post":{"description":"Create an API key owned by the caller, in a workspace they may see.\n\nThe member-scoped counterpart of ``POST /api/v1/keys``: the owner is always the\ncaller's own attribution user, the key is always budget-enforced, and the\nworkspace must be visible to the caller (a member of it, or an organization\nowner/admin, who see every workspace). A viewer of the workspace is refused\nwith 403. The secret is returned once.","operationId":"organization-keys-create_own_key","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateOwnKeyRequest"}}},"required":true},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateKeyResponse"}}},"description":"Successful Response"},"422":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}},"description":"Validation Error"}},"summary":"Create Own Key","tags":["organization-keys"]}}}}
```

## Update Own Key

> Update one of the caller's own API keys.

```json
{"openapi":"3.1.0","info":{"title":"otari","version":"0.33.0"},"security":[{"ApiKeyAuth":[]},{"XApiKeyAuth":[]}],"components":{"securitySchemes":{"ApiKeyAuth":{"description":"Enter your API key here (sent as Otari-Key header).","in":"header","name":"Otari-Key","type":"apiKey"},"XApiKeyAuth":{"description":"Anthropic-native clients send credentials here (no Bearer prefix).","in":"header","name":"x-api-key","type":"apiKey"}},"schemas":{"UpdateOwnKeyRequest":{"description":"Update-key body for the member surface.\n\nThe operator's ``UpdateKeyRequest`` minus ``exclude_from_budget``, for the\nreason the create body gives. The tri-state fields follow the same\n``model_fields_set`` idiom: absent = unchanged, null = clear to inherit,\na value = pin it.","properties":{"allowed_models":{"anyOf":[{"items":{"type":"string"},"type":"array"},{"type":"null"}],"title":"Allowed Models"},"allowed_tools":{"anyOf":[{"items":{"type":"string"},"type":"array"},{"type":"null"}],"title":"Allowed Tools"},"capture_agent_telemetry":{"anyOf":[{"type":"boolean"},{"type":"null"}],"title":"Capture Agent Telemetry"},"expires_at":{"anyOf":[{"format":"date-time","type":"string"},{"type":"null"}],"title":"Expires At"},"is_active":{"anyOf":[{"type":"boolean"},{"type":"null"}],"title":"Is Active"},"key_name":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Key Name"},"metadata":{"anyOf":[{"additionalProperties":true,"type":"object"},{"type":"null"}],"title":"Metadata"},"reject_user_mismatch":{"anyOf":[{"type":"boolean"},{"type":"null"}],"title":"Reject User Mismatch"}},"title":"UpdateOwnKeyRequest","type":"object"},"KeyInfo":{"description":"Response model for key information.","properties":{"allowed_models":{"anyOf":[{"items":{"type":"string"},"type":"array"},{"type":"null"}],"title":"Allowed Models"},"allowed_tools":{"anyOf":[{"items":{"type":"string"},"type":"array"},{"type":"null"}],"title":"Allowed Tools"},"capture_agent_telemetry":{"anyOf":[{"type":"boolean"},{"type":"null"}],"title":"Capture Agent Telemetry"},"config_name":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Config Name"},"created_at":{"title":"Created At","type":"string"},"end_user_budget_id":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"End User Budget Id"},"end_user_budget_ids":{"items":{"type":"string"},"title":"End User Budget Ids","type":"array"},"exclude_from_budget":{"title":"Exclude From Budget","type":"boolean"},"expires_at":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Expires At"},"id":{"title":"Id","type":"string"},"is_active":{"title":"Is Active","type":"boolean"},"is_service_key":{"title":"Is Service Key","type":"boolean"},"key_name":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Key Name"},"key_prefix":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Key Prefix"},"key_suffix":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Key Suffix"},"last_used_at":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Last Used At"},"max_end_users":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Max End Users"},"metadata":{"additionalProperties":true,"title":"Metadata","type":"object"},"operator_disabled":{"default":false,"title":"Operator Disabled","type":"boolean"},"reject_user_mismatch":{"anyOf":[{"type":"boolean"},{"type":"null"}],"title":"Reject User Mismatch"},"user_id":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"User Id"},"workspace_id":{"format":"uuid","title":"Workspace Id","type":"string"}},"required":["id","key_prefix","key_suffix","key_name","user_id","created_at","last_used_at","expires_at","is_active","allowed_models","allowed_tools","exclude_from_budget","reject_user_mismatch","capture_agent_telemetry","is_service_key","end_user_budget_id","end_user_budget_ids","workspace_id","metadata"],"title":"KeyInfo","type":"object"},"HTTPValidationError":{"properties":{"code":{"const":"invalid_request","description":"Stable error code, also sent as the Otari-Error-Code header.","title":"Code","type":"string"},"detail":{"items":{"$ref":"#/components/schemas/ValidationError"},"title":"Detail","type":"array"}},"title":"HTTPValidationError","type":"object"},"ValidationError":{"properties":{"ctx":{"title":"Context","type":"object"},"input":{"title":"Input"},"loc":{"items":{"anyOf":[{"type":"string"},{"type":"integer"}]},"title":"Location","type":"array"},"msg":{"title":"Message","type":"string"},"type":{"title":"Error Type","type":"string"}},"required":["loc","msg","type"],"title":"ValidationError","type":"object"}}},"paths":{"/api/v1/organizations/me/keys/{key_id}":{"patch":{"description":"Update one of the caller's own API keys.","operationId":"organization-keys-update_own_key","parameters":[{"in":"path","name":"key_id","required":true,"schema":{"title":"Key Id","type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateOwnKeyRequest"}}},"required":true},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/KeyInfo"}}},"description":"Successful Response"},"422":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}},"description":"Validation Error"}},"summary":"Update Own Key","tags":["organization-keys"]}}}}
```

## Delete Own Key

> Delete (revoke) one of the caller's own API keys.

```json
{"openapi":"3.1.0","info":{"title":"otari","version":"0.33.0"},"security":[{"ApiKeyAuth":[]},{"XApiKeyAuth":[]}],"components":{"securitySchemes":{"ApiKeyAuth":{"description":"Enter your API key here (sent as Otari-Key header).","in":"header","name":"Otari-Key","type":"apiKey"},"XApiKeyAuth":{"description":"Anthropic-native clients send credentials here (no Bearer prefix).","in":"header","name":"x-api-key","type":"apiKey"}},"schemas":{"HTTPValidationError":{"properties":{"code":{"const":"invalid_request","description":"Stable error code, also sent as the Otari-Error-Code header.","title":"Code","type":"string"},"detail":{"items":{"$ref":"#/components/schemas/ValidationError"},"title":"Detail","type":"array"}},"title":"HTTPValidationError","type":"object"},"ValidationError":{"properties":{"ctx":{"title":"Context","type":"object"},"input":{"title":"Input"},"loc":{"items":{"anyOf":[{"type":"string"},{"type":"integer"}]},"title":"Location","type":"array"},"msg":{"title":"Message","type":"string"},"type":{"title":"Error Type","type":"string"}},"required":["loc","msg","type"],"title":"ValidationError","type":"object"}}},"paths":{"/api/v1/organizations/me/keys/{key_id}":{"delete":{"description":"Delete (revoke) one of the caller's own API keys.","operationId":"organization-keys-delete_own_key","parameters":[{"in":"path","name":"key_id","required":true,"schema":{"title":"Key Id","type":"string"}}],"responses":{"204":{"description":"Successful Response"},"422":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}},"description":"Validation Error"}},"summary":"Delete Own Key","tags":["organization-keys"]}}}}
```

## List Own Federation Rules

> List the identities that may authenticate as a key, oldest first.\
> \
> The caller's own key, or for the deployment operator any key in their active organization. Includes any rule\
> the operator gave the key on \`\`/api/v1/keys\`\`, which \`\`member\_managed\`\` tells apart.

```json
{"openapi":"3.1.0","info":{"title":"otari","version":"0.33.0"},"security":[{"ApiKeyAuth":[]},{"XApiKeyAuth":[]}],"components":{"securitySchemes":{"ApiKeyAuth":{"description":"Enter your API key here (sent as Otari-Key header).","in":"header","name":"Otari-Key","type":"apiKey"},"XApiKeyAuth":{"description":"Anthropic-native clients send credentials here (no Bearer prefix).","in":"header","name":"x-api-key","type":"apiKey"}},"schemas":{"FederationRulePublic":{"description":"A federation rule of an API key.","properties":{"api_key_id":{"title":"Api Key Id","type":"string"},"audience":{"title":"Audience","type":"string"},"created_at":{"format":"date-time","title":"Created At","type":"string"},"email":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Email"},"id":{"title":"Id","type":"string"},"issuer":{"title":"Issuer","type":"string"},"member_managed":{"description":"Whether a member gave the rule to their own key: it then matches only in the token exchange.","title":"Member Managed","type":"boolean"},"subject":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Subject"}},"required":["id","api_key_id","issuer","audience","subject","email","member_managed","created_at"],"title":"FederationRulePublic","type":"object"},"HTTPValidationError":{"properties":{"code":{"const":"invalid_request","description":"Stable error code, also sent as the Otari-Error-Code header.","title":"Code","type":"string"},"detail":{"items":{"$ref":"#/components/schemas/ValidationError"},"title":"Detail","type":"array"}},"title":"HTTPValidationError","type":"object"},"ValidationError":{"properties":{"ctx":{"title":"Context","type":"object"},"input":{"title":"Input"},"loc":{"items":{"anyOf":[{"type":"string"},{"type":"integer"}]},"title":"Location","type":"array"},"msg":{"title":"Message","type":"string"},"type":{"title":"Error Type","type":"string"}},"required":["loc","msg","type"],"title":"ValidationError","type":"object"}}},"paths":{"/api/v1/organizations/me/keys/{key_id}/federation-rules":{"get":{"description":"List the identities that may authenticate as a key, oldest first.\n\nThe caller's own key, or for the deployment operator any key in their active organization. Includes any rule\nthe operator gave the key on ``/api/v1/keys``, which ``member_managed`` tells apart.","operationId":"organization-keys-list_own_federation_rules","parameters":[{"in":"path","name":"key_id","required":true,"schema":{"title":"Key Id","type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"items":{"$ref":"#/components/schemas/FederationRulePublic"},"title":"Response Organization-Keys-List Own Federation Rules","type":"array"}}},"description":"Successful Response"},"422":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}},"description":"Validation Error"}},"summary":"List Own Federation Rules","tags":["organization-keys"]}}}}
```

## Create Own Federation Rule

> Let an OpenID Connect identity token stand in for a key, through the token exchange.\
> \
> Needs \`\`federation\_member\_rules\`\`, else 403, and an organization owner or admin acting on their own key, or the\
> deployment operator on any key in their active organization, else 403. The issuer may be any https URL; its\
> signing keys are fetched only from a public host. The rule matches only in \`\`POST /api/v1/oauth/token\`\` naming\
> its id, never as a bare identity token, so it lets a workload act as this key and no other: a rule naming another\
> tenant's workload gives that workload nothing it did not ask for. A rule this key already holds answers 409.

```json
{"openapi":"3.1.0","info":{"title":"otari","version":"0.33.0"},"security":[{"ApiKeyAuth":[]},{"XApiKeyAuth":[]}],"components":{"securitySchemes":{"ApiKeyAuth":{"description":"Enter your API key here (sent as Otari-Key header).","in":"header","name":"Otari-Key","type":"apiKey"},"XApiKeyAuth":{"description":"Anthropic-native clients send credentials here (no Bearer prefix).","in":"header","name":"x-api-key","type":"apiKey"}},"schemas":{"FederationRuleCreate":{"additionalProperties":false,"description":"An OpenID Connect identity that may authenticate as the key, in place of its secret.\n\nA token matches when it is signed by ``issuer``, names ``audience`` among its audiences, and carries each of\n``subject`` and ``email`` that the rule sets; an email matches only when the token marks it verified. At least\none of the two is required.","properties":{"audience":{"description":"A value the token's 'aud' must contain.","maxLength":512,"minLength":1,"title":"Audience","type":"string"},"email":{"anyOf":[{"maxLength":320,"minLength":3,"type":"string"},{"type":"null"}],"description":"The token's verified 'email', when the rule names one. Compared without regard to case.","title":"Email"},"issuer":{"description":"The token's 'iss'. On an operator's rule, one of the deployment's federation_issuers; on a member's own key, any https issuer, whose discovery document and signing keys are fetched only from a public host.","maxLength":512,"minLength":1,"title":"Issuer","type":"string"},"subject":{"anyOf":[{"maxLength":255,"minLength":1,"type":"string"},{"type":"null"}],"description":"The token's 'sub', when the rule names one.","title":"Subject"}},"required":["issuer","audience"],"title":"FederationRuleCreate","type":"object"},"FederationRulePublic":{"description":"A federation rule of an API key.","properties":{"api_key_id":{"title":"Api Key Id","type":"string"},"audience":{"title":"Audience","type":"string"},"created_at":{"format":"date-time","title":"Created At","type":"string"},"email":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Email"},"id":{"title":"Id","type":"string"},"issuer":{"title":"Issuer","type":"string"},"member_managed":{"description":"Whether a member gave the rule to their own key: it then matches only in the token exchange.","title":"Member Managed","type":"boolean"},"subject":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Subject"}},"required":["id","api_key_id","issuer","audience","subject","email","member_managed","created_at"],"title":"FederationRulePublic","type":"object"},"HTTPValidationError":{"properties":{"code":{"const":"invalid_request","description":"Stable error code, also sent as the Otari-Error-Code header.","title":"Code","type":"string"},"detail":{"items":{"$ref":"#/components/schemas/ValidationError"},"title":"Detail","type":"array"}},"title":"HTTPValidationError","type":"object"},"ValidationError":{"properties":{"ctx":{"title":"Context","type":"object"},"input":{"title":"Input"},"loc":{"items":{"anyOf":[{"type":"string"},{"type":"integer"}]},"title":"Location","type":"array"},"msg":{"title":"Message","type":"string"},"type":{"title":"Error Type","type":"string"}},"required":["loc","msg","type"],"title":"ValidationError","type":"object"}}},"paths":{"/api/v1/organizations/me/keys/{key_id}/federation-rules":{"post":{"description":"Let an OpenID Connect identity token stand in for a key, through the token exchange.\n\nNeeds ``federation_member_rules``, else 403, and an organization owner or admin acting on their own key, or the\ndeployment operator on any key in their active organization, else 403. The issuer may be any https URL; its\nsigning keys are fetched only from a public host. The rule matches only in ``POST /api/v1/oauth/token`` naming\nits id, never as a bare identity token, so it lets a workload act as this key and no other: a rule naming another\ntenant's workload gives that workload nothing it did not ask for. A rule this key already holds answers 409.","operationId":"organization-keys-create_own_federation_rule","parameters":[{"in":"path","name":"key_id","required":true,"schema":{"title":"Key Id","type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/FederationRuleCreate"}}},"required":true},"responses":{"201":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/FederationRulePublic"}}},"description":"Successful Response"},"422":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}},"description":"Validation Error"}},"summary":"Create Own Federation Rule","tags":["organization-keys"]}}}}
```

## Delete Own Federation Rule

> Remove a federation rule from a key. Tokens it matched stop with the next request.\
> \
> The caller's own key whatever their role, or for the deployment operator any key in their active organization.\
> Works whether or not \`\`federation\_member\_rules\`\` is on, so a rule can always be taken back.

```json
{"openapi":"3.1.0","info":{"title":"otari","version":"0.33.0"},"security":[{"ApiKeyAuth":[]},{"XApiKeyAuth":[]}],"components":{"securitySchemes":{"ApiKeyAuth":{"description":"Enter your API key here (sent as Otari-Key header).","in":"header","name":"Otari-Key","type":"apiKey"},"XApiKeyAuth":{"description":"Anthropic-native clients send credentials here (no Bearer prefix).","in":"header","name":"x-api-key","type":"apiKey"}},"schemas":{"HTTPValidationError":{"properties":{"code":{"const":"invalid_request","description":"Stable error code, also sent as the Otari-Error-Code header.","title":"Code","type":"string"},"detail":{"items":{"$ref":"#/components/schemas/ValidationError"},"title":"Detail","type":"array"}},"title":"HTTPValidationError","type":"object"},"ValidationError":{"properties":{"ctx":{"title":"Context","type":"object"},"input":{"title":"Input"},"loc":{"items":{"anyOf":[{"type":"string"},{"type":"integer"}]},"title":"Location","type":"array"},"msg":{"title":"Message","type":"string"},"type":{"title":"Error Type","type":"string"}},"required":["loc","msg","type"],"title":"ValidationError","type":"object"}}},"paths":{"/api/v1/organizations/me/keys/{key_id}/federation-rules/{rule_id}":{"delete":{"description":"Remove a federation rule from a key. Tokens it matched stop with the next request.\n\nThe caller's own key whatever their role, or for the deployment operator any key in their active organization.\nWorks whether or not ``federation_member_rules`` is on, so a rule can always be taken back.","operationId":"organization-keys-delete_own_federation_rule","parameters":[{"in":"path","name":"key_id","required":true,"schema":{"title":"Key Id","type":"string"}},{"in":"path","name":"rule_id","required":true,"schema":{"title":"Rule Id","type":"string"}}],"responses":{"204":{"description":"Successful Response"},"422":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}},"description":"Validation Error"}},"summary":"Delete Own Federation Rule","tags":["organization-keys"]}}}}
```

## Rotate Own Key

> Rotate the secret of one of the caller's own API keys, in place.\
> \
> Same contract as the operator's rotate: the row keeps its identity, the new\
> raw key is returned once, and the previous secret stops authenticating\
> immediately with no grace window.

```json
{"openapi":"3.1.0","info":{"title":"otari","version":"0.33.0"},"security":[{"ApiKeyAuth":[]},{"XApiKeyAuth":[]}],"components":{"securitySchemes":{"ApiKeyAuth":{"description":"Enter your API key here (sent as Otari-Key header).","in":"header","name":"Otari-Key","type":"apiKey"},"XApiKeyAuth":{"description":"Anthropic-native clients send credentials here (no Bearer prefix).","in":"header","name":"x-api-key","type":"apiKey"}},"schemas":{"CreateKeyResponse":{"description":"Response model for creating a new API key.","properties":{"allowed_models":{"anyOf":[{"items":{"type":"string"},"type":"array"},{"type":"null"}],"title":"Allowed Models"},"allowed_tools":{"anyOf":[{"items":{"type":"string"},"type":"array"},{"type":"null"}],"title":"Allowed Tools"},"capture_agent_telemetry":{"anyOf":[{"type":"boolean"},{"type":"null"}],"title":"Capture Agent Telemetry"},"created_at":{"title":"Created At","type":"string"},"end_user_budget_id":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"End User Budget Id"},"end_user_budget_ids":{"items":{"type":"string"},"title":"End User Budget Ids","type":"array"},"exclude_from_budget":{"title":"Exclude From Budget","type":"boolean"},"expires_at":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Expires At"},"id":{"title":"Id","type":"string"},"is_active":{"title":"Is Active","type":"boolean"},"is_service_key":{"title":"Is Service Key","type":"boolean"},"key":{"title":"Key","type":"string"},"key_name":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Key Name"},"key_prefix":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Key Prefix"},"key_suffix":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Key Suffix"},"max_end_users":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Max End Users"},"metadata":{"additionalProperties":true,"title":"Metadata","type":"object"},"reject_user_mismatch":{"anyOf":[{"type":"boolean"},{"type":"null"}],"title":"Reject User Mismatch"},"user_id":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"User Id"}},"required":["id","key","key_prefix","key_suffix","key_name","user_id","created_at","expires_at","is_active","allowed_models","allowed_tools","exclude_from_budget","reject_user_mismatch","capture_agent_telemetry","is_service_key","end_user_budget_id","end_user_budget_ids","max_end_users","metadata"],"title":"CreateKeyResponse","type":"object"},"HTTPValidationError":{"properties":{"code":{"const":"invalid_request","description":"Stable error code, also sent as the Otari-Error-Code header.","title":"Code","type":"string"},"detail":{"items":{"$ref":"#/components/schemas/ValidationError"},"title":"Detail","type":"array"}},"title":"HTTPValidationError","type":"object"},"ValidationError":{"properties":{"ctx":{"title":"Context","type":"object"},"input":{"title":"Input"},"loc":{"items":{"anyOf":[{"type":"string"},{"type":"integer"}]},"title":"Location","type":"array"},"msg":{"title":"Message","type":"string"},"type":{"title":"Error Type","type":"string"}},"required":["loc","msg","type"],"title":"ValidationError","type":"object"}}},"paths":{"/api/v1/organizations/me/keys/{key_id}/rotate":{"post":{"description":"Rotate the secret of one of the caller's own API keys, in place.\n\nSame contract as the operator's rotate: the row keeps its identity, the new\nraw key is returned once, and the previous secret stops authenticating\nimmediately with no grace window.","operationId":"organization-keys-rotate_own_key","parameters":[{"in":"path","name":"key_id","required":true,"schema":{"title":"Key Id","type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateKeyResponse"}}},"description":"Successful Response"},"422":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}},"description":"Validation Error"}},"summary":"Rotate Own Key","tags":["organization-keys"]}}}}
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.otari.ai/otari/for-integrators/api-reference/organization-keys.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.