Endpoints

Summary

The scope column applies to service tokens. Device tokens are limited by role instead: viewers cannot create, update or delete keys.

List keys

GET /api/keys. Add ?environment=Production to filter. Values are never returned, only the masked preview.

[
  {
    "id": "key_id",
    "name": "STRIPE_SECRET",
    "service": "Stripe",
    "environment": "Production",
    "notes": "Billing API",
    "createdAt": "2026-10-01T09:30:00.000Z",
    "updatedAt": "2026-10-01T09:30:00.000Z",
    "last_used": null,
    "masked": "sk_live_••••1234"
  }
]

Get a key

GET /api/keys/{id} returns one object in the same shape, or 404. A key outside a service token's environment pin also returns 404.

Create a key

POST /api/keys. name and key are required. service defaults to Custom, and environment to Production or the token's pin. A name already used in that environment returns 409 DUPLICATE_KEY.

curl -X POST https://apivault.tech/api/keys \
  -H "Authorization: Bearer $APIVAULT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "STRIPE_SECRET",
    "key": "sk_live_...",
    "service": "Stripe",
    "environment": "Production",
    "notes": "Billing API"
  }'

Returns the new key with its id and masked preview.

Create many keys

POST /api/keys/bulk saves every item or none. service and notes at the top level are defaults that an item can override; environment applies to the whole batch.

{
  "environment": "Staging",
  "service": "Custom",
  "items": [
    { "name": "OPENAI_API_KEY", "key": "sk-...", "service": "OpenAI" },
    { "name": "SENTRY_DSN", "key": "https://..." }
  ]
}

Returns {"created": 2, "keys": [...]}. An invalid item returns 400 with a fieldErrors list giving each item's index and error.

Update a key

PUT /api/keys/{id}. Send only the fields to change, from name, service, environment, notes and key. Sending key changes the value, which is recorded in the audit log as a rotation and needs the vault key in custom mode.

curl -X PUT https://apivault.tech/api/keys/$KEY_ID \
  -H "Authorization: Bearer $APIVAULT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "key": "sk_live_new..." }'

Returns the updated key in the same shape as Get a key, with masked showing the new preview after a rotation. The response never includes the value or its encrypted form; use Reveal a key to read the value.

Delete a key

DELETE /api/keys/{id} returns {"success": true}. It cannot be undone.

Reveal a key

POST /api/keys/{id}/decrypt returns the key with its value in rawKey. Every reveal is recorded in the audit log.

curl -X POST https://apivault.tech/api/keys/$KEY_ID/decrypt \
  -H "Authorization: Bearer $APIVAULT_TOKEN" | jq -r .rawKey

Export an environment

GET /api/keys/export returns one environment as dotenv text inside a JSON object, under envText. environment defaults to Production, or the token's pin. When a service token exports, the project's owners and admins are notified.

curl "https://apivault.tech/api/keys/export?environment=Production" \
  -H "Authorization: Bearer $APIVAULT_TOKEN" | jq -r .envText > .env

Check the token

GET /api/cli/me tells you what a token is. A service token returns kind, name, projectId, scopes and environment; a device token returns kind, email and name.

Device-token endpoints

These act on your account or a whole project, so service tokens cannot use them.