# Organization API: API Keys

> Create and revoke organization API keys.

Source: https://www.coritan.com/docs/api/reference/organizations/api-keys/

Create and revoke organization API keys. `X-API-Key` authenticates the commerce merchant API when the key carries commerce scopes; other org routes take a Bearer token.

Base URL: `https://api.coritan.com/api/v1`. Paths below are complete.

To try these requests in the browser, open the [interactive Organization API reference](https://api.coritan.com/docs/org).

## Operations

| Method | Path | Summary |
| --- | --- | --- |
| GET | [`/api/v1/orgs/{org_slug}/api-keys`](#op-get-api-v1-orgs-org-slug-api-keys) | List API keys |
| POST | [`/api/v1/orgs/{org_slug}/api-keys`](#op-post-api-v1-orgs-org-slug-api-keys) | Create API key |
| DELETE | [`/api/v1/orgs/{org_slug}/api-keys/{key_id}`](#op-delete-api-v1-orgs-org-slug-api-keys-key-id) | Revoke API key |
| GET | [`/api/v1/orgs/{org_slug}/mail/tenants/{tenant_id}/api-keys`](#op-get-api-v1-orgs-org-slug-mail-tenants-tenant-id-api-keys) | List API keys |
| POST | [`/api/v1/orgs/{org_slug}/mail/tenants/{tenant_id}/api-keys`](#op-post-api-v1-orgs-org-slug-mail-tenants-tenant-id-api-keys) | Create API key |
| DELETE | [`/api/v1/orgs/{org_slug}/mail/tenants/{tenant_id}/api-keys/{key_id}`](#op-delete-api-v1-orgs-org-slug-mail-tenants-tenant-id-api-keys-key-id) | Revoke API key |
| GET | [`/api/v1/orgs/{org_slug}/staff/settings/api-keys`](#op-get-api-v1-orgs-org-slug-staff-settings-api-keys) | Staff list API keys |
| POST | [`/api/v1/orgs/{org_slug}/staff/settings/api-keys`](#op-post-api-v1-orgs-org-slug-staff-settings-api-keys) | A key for the brand's own integrations |
| DELETE | [`/api/v1/orgs/{org_slug}/staff/settings/api-keys/{key_id}`](#op-delete-api-v1-orgs-org-slug-staff-settings-api-keys-key-id) | Staff revoke API key |

### List API keys {#op-get-api-v1-orgs-org-slug-api-keys}

`GET /api/v1/orgs/{org_slug}/api-keys`

#### Parameters

| Name | In | Type | Required |
| --- | --- | --- | --- |
| `org_slug` | path | string | yes |

#### Responses

| Status | Meaning |
| --- | --- |
| `200` | Success. |
| `422` | The request is not valid. `detail` lists each problem. |

A `200` response is a list; each item has these fields:

| Field | Type |
| --- | --- |
| `[].id` | integer |
| `[].org_id` | integer |
| `[].label` | string |
| `[].permissions` | object or null |
| `[].rate_limit_per_hour` | integer |
| `[].ip_whitelist` | array of any or null |
| `[].is_active` | boolean |
| `[].last_used_at` | string (date-time) or null |
| `[].created_at` | string (date-time) or null |

### Create API key {#op-post-api-v1-orgs-org-slug-api-keys}

`POST /api/v1/orgs/{org_slug}/api-keys`

#### Parameters

| Name | In | Type | Required |
| --- | --- | --- | --- |
| `org_slug` | path | string | yes |

#### Request body

`application/json` (required)

| Field | Type | Required |
| --- | --- | --- |
| `label` | string | yes |
| `permissions` | object or null | no |
| `rate_limit_per_hour` | integer | no |
| `ip_whitelist` | array of string or null | no |

#### Responses

| Status | Meaning |
| --- | --- |
| `201` | Success. |
| `422` | The request is not valid. `detail` lists each problem. |

Fields of a `201` response:

| Field | Type |
| --- | --- |
| `id` | integer |
| `org_id` | integer |
| `label` | string |
| `permissions` | object or null |
| `rate_limit_per_hour` | integer |
| `ip_whitelist` | array of any or null |
| `is_active` | boolean |
| `last_used_at` | string (date-time) or null |
| `created_at` | string (date-time) or null |
| `raw_key` | string |

### Revoke API key {#op-delete-api-v1-orgs-org-slug-api-keys-key-id}

`DELETE /api/v1/orgs/{org_slug}/api-keys/{key_id}`

#### Parameters

| Name | In | Type | Required |
| --- | --- | --- | --- |
| `key_id` | path | integer | yes |
| `org_slug` | path | string | yes |

#### Responses

| Status | Meaning |
| --- | --- |
| `200` | Success. |
| `422` | The request is not valid. `detail` lists each problem. |

### List API keys {#op-get-api-v1-orgs-org-slug-mail-tenants-tenant-id-api-keys}

`GET /api/v1/orgs/{org_slug}/mail/tenants/{tenant_id}/api-keys`

#### Parameters

| Name | In | Type | Required |
| --- | --- | --- | --- |
| `org_slug` | path | string | yes |
| `tenant_id` | path | integer | yes |

#### Responses

| Status | Meaning |
| --- | --- |
| `200` | Success. |
| `422` | The request is not valid. `detail` lists each problem. |

### Create API key {#op-post-api-v1-orgs-org-slug-mail-tenants-tenant-id-api-keys}

`POST /api/v1/orgs/{org_slug}/mail/tenants/{tenant_id}/api-keys`

#### Parameters

| Name | In | Type | Required |
| --- | --- | --- | --- |
| `org_slug` | path | string | yes |
| `tenant_id` | path | integer | yes |

#### Request body

`application/json` (required)

| Field | Type | Required |
| --- | --- | --- |
| `label` | string | no |

#### Responses

| Status | Meaning |
| --- | --- |
| `201` | Success. |
| `422` | The request is not valid. `detail` lists each problem. |

### Revoke API key {#op-delete-api-v1-orgs-org-slug-mail-tenants-tenant-id-api-keys-key-id}

`DELETE /api/v1/orgs/{org_slug}/mail/tenants/{tenant_id}/api-keys/{key_id}`

#### Parameters

| Name | In | Type | Required |
| --- | --- | --- | --- |
| `key_id` | path | integer | yes |
| `org_slug` | path | string | yes |
| `tenant_id` | path | integer | yes |

#### Responses

| Status | Meaning |
| --- | --- |
| `200` | Success. |
| `422` | The request is not valid. `detail` lists each problem. |

### Staff list API keys {#op-get-api-v1-orgs-org-slug-staff-settings-api-keys}

`GET /api/v1/orgs/{org_slug}/staff/settings/api-keys`

#### Parameters

| Name | In | Type | Required |
| --- | --- | --- | --- |
| `org_slug` | path | string | yes |

#### Responses

| Status | Meaning |
| --- | --- |
| `200` | Success. |
| `422` | The request is not valid. `detail` lists each problem. |

### A key for the brand's own integrations {#op-post-api-v1-orgs-org-slug-staff-settings-api-keys}

`POST /api/v1/orgs/{org_slug}/staff/settings/api-keys`

A key for the brand's own integrations. Shown once; only its hash is kept.

#### Parameters

| Name | In | Type | Required |
| --- | --- | --- | --- |
| `org_slug` | path | string | yes |

#### Request body

`application/json` (required)

| Field | Type | Required |
| --- | --- | --- |
| `label` | string | yes |
| `rate_limit_per_hour` | integer | no |
| `ip_whitelist` | array of string or null | no |

#### Responses

| Status | Meaning |
| --- | --- |
| `201` | Success. |
| `422` | The request is not valid. `detail` lists each problem. |

### Staff revoke API key {#op-delete-api-v1-orgs-org-slug-staff-settings-api-keys-key-id}

`DELETE /api/v1/orgs/{org_slug}/staff/settings/api-keys/{key_id}`

#### Parameters

| Name | In | Type | Required |
| --- | --- | --- | --- |
| `key_id` | path | integer | yes |
| `org_slug` | path | string | yes |

#### Responses

| Status | Meaning |
| --- | --- |
| `200` | Success. |
| `422` | The request is not valid. `detail` lists each problem. |