Engramma

API Keys

beginner

Create, list, update, and revoke API keys. Shortcut endpoints resolve organization from JWT.

List API keys

GET/v1/api-keys

List API keys for the organization resolved from JWT.

200Response
[
  {
    "id": "key-uuid",
    "name": "Production Backend",
    "key_prefix": "ek_live_a1b2",
    "environment": "live",
    "scopes": [
      "memory:read",
      "memory:write"
    ],
    "last_used_at": "2026-01-20T14:30:00Z",
    "expires_at": null,
    "created_at": "2026-01-15T10:00:00Z"
  }
]
curl https://api.engramma-memory.com/v1/api-keys \
  -H "Authorization: Bearer $JWT_TOKEN"

Create API key

POST/v1/api-keys

Create an API key for the organization resolved from JWT.

namestringrequired

Descriptive name for the key (1–100 characters).

environmentstringDefault: live

Key environment: live or test.

scopesarray[string] | null

Permission scopes. Null for full access.

expires_atstring | null

Optional expiration date (ISO 8601).

201Response
{
  "id": "key-uuid",
  "name": "Staging Environment",
  "key": "ek_live_a1b2c3d4e5f6...",
  "key_prefix": "ek_live_a1b2",
  "environment": "live",
  "scopes": [
    "memory:read",
    "memory:write"
  ],
  "created_at": "2026-01-20T10:00:00Z",
  "message": "Store this key securely. It will not be shown again."
}
Danger

The full API key value is only shown once in this response. Store it securely immediately.

Update API key

PATCH/v1/api-keys/{key_id}

Update an API key's name, scopes, or expiration.

key_idstringrequired

API key ID (path parameter, UUID format).

namestring | null

New name (1–100 characters).

scopesarray[string] | null

New scopes.

expires_atstring | null

New expiration date.

200Response
{
  "id": "key-uuid",
  "name": "Staging Environment (Updated)",
  "key_prefix": "ek_live_a1b2",
  "environment": "live",
  "scopes": [
    "memory:read"
  ],
  "last_used_at": "2026-01-20T14:30:00Z",
  "expires_at": "2026-06-01T00:00:00Z",
  "created_at": "2026-01-15T10:00:00Z"
}

Revoke API key

DELETE/v1/api-keys/{key_id}

Immediately revoke an API key.

key_idstringrequired

API key ID (path parameter, UUID format).

200Response
{
  "message": "API key revoked"
}
Warning

Revoking is immediate. All requests using this key will receive 401 errors.

Organization-scoped endpoints

These endpoints perform the same operations but require an explicit org_id path parameter instead of resolving the organization from JWT:

MethodPathDescription
GET/v1/organizations/{org_id}/api-keysList org API keys
POST/v1/organizations/{org_id}/api-keysCreate org API key
PATCH/v1/organizations/{org_id}/api-keys/{key_id}Update org API key
DELETE/v1/organizations/{org_id}/api-keys/{key_id}Revoke org API key

See Organizations for details.

Next steps

UsersMemory Text