Harthelm Docs
REST APIAPI keys

Create an API key

Mints `hart_<id>_<secret>` for the caller. The response carries the key in `token` once; only the SHA-256 of the secret is stored. Use it as `Authorization: Bearer …` or `Harthelm-Authorization: Bearer …` on the API and as `Harthelm-Authorization: Bearer …` on private dev hosts and restricted custom domains. Browser sessions only (403 with an API key), so a leaked key cannot mint a successor that outlives its deletion.

Generated from openapi/harthelm.yaml at v1.5.0
POST
/me/api-keys

Authorization

cookie__Host-harthelm_session<token>

Browser session of the UI (12 h idle, 7 days absolute). State-changing requests also need the header Harthelm-CSRF: 1 and a matching Origin.

Header Parameters

Idempotency-Key?string

Client-chosen key (at most 255 characters); a repeated key returns the first result for 24 h.

Length1 <= length <= 255

Request Body

application/json
  1. body
name*ApiKeyName

1 to 100 characters without leading or trailing spaces; need not be unique.

Match^\S(.*\S)?$
Length1 <= length <= 100
expires_at?string

Optional; must be in the future and at most a year away.

Formatdate-time

Response Body

The key, with its token.

application/json
  1. response

A personal API key without its secret.

id*string
Formatuuid
name*ApiKeyName

1 to 100 characters without leading or trailing spaces; need not be unique.

Match^\S(.*\S)?$
Length1 <= length <= 100
source*string

cli: minted by hart login.

Value in"console""cli"
prefix*string

The token up to its secret (hart_<id>_), so a user can tell keys apart in a script.

created_at*string
Formatdate-time
regenerated_at?string
Formatdate-time
last_used_at?string

When core last authenticated a request with the key, updated at most once per hour. The routers' offline checks on workspace hosts do not count.

Formatdate-time
expires_at?string

Absent for a key that does not expire.

Formatdate-time
token*string

hart_<id>_<secret>, shown this once.

curl -X POST 'https://console.example.com/api/v1/me/api-keys' \  -H 'Content-Type: application/json' \  -d '{  "name": "string"}'
{  "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",  "name": "string",  "source": "console",  "prefix": "string",  "created_at": "2019-08-24T14:15:22Z",  "regenerated_at": "2019-08-24T14:15:22Z",  "last_used_at": "2019-08-24T14:15:22Z",  "expires_at": "2019-08-24T14:15:22Z",  "token": "string"}

The audit log

Cluster admins only (`platform.admin`; `hart admin audit`). The audit log, newest first (by time, then id); the filters combine. A malformed `action`, a cursor this API did not return or an `actor` or `team` below 1 is `422`; a malformed time is `400`.

Delete an API key

The key stops working at once, also on workspace hosts (the routers drop it with the next route delta).