> For the complete documentation index, see [llms.txt](https://docs.visualsentinel.com/llms.txt)

# API Keys API

API key management. This page lists all 3 endpoints in the API Keys area of the Visual Sentinel REST API.

Base URL: `https://visualsentinel.com`. Unless an endpoint says otherwise it accepts an API key or a session cookie, see [Authentication](https://docs.visualsentinel.com/guides/authentication.md). Most error responses use the [ErrorResponse](https://docs.visualsentinel.com/reference/models/error-response.md) shape, see [Errors](https://docs.visualsentinel.com/guides/errors.md) and [Rate limits](https://docs.visualsentinel.com/guides/rate-limits.md).

## Endpoints

- [List API keys](#list-api-keys): `GET /api/api-keys`
- [Create API key](#create-api-key): `POST /api/api-keys`
- [Delete API key](#delete-api-key): `DELETE /api/api-keys`

## List API keys

`GET /api/api-keys`

Get all API keys for the organization.

**Responses**

- `200`: List of API keys. Body: array of [ApiKey](https://docs.visualsentinel.com/reference/models/api-key.md).

## Create API key

`POST /api/api-keys`

Generate a new API key for programmatic access. Requires a paid plan: API access comes with every paid plan (Solo, Starter, Business, Agency and custom Enterprise plans).

Authentication: session cookie only. API keys are refused.

Request body (required): object.

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `name` | string | Yes | Min length 1, max length 100. |
| `scopes` | array of string | Yes | Required. At least one scope, e.g. monitors:read, servers:write, * etc. Min items 1. |
| `expiresAt` | string (date-time) | No | ISO 8601 expiry timestamp (preferred). Takes precedence over expiresIn. |
| `expiresIn` | integer | No | Legacy alternative to expiresAt: number of days until the key expires. Used only when expiresAt is omitted. Minimum 1. |

**Responses**

- `201`: API key created (key shown only once) Body: [ApiKey](https://docs.visualsentinel.com/reference/models/api-key.md) and object.

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `key` | string | No | The actual API key value (shown only once) |

## Delete API key

`DELETE /api/api-keys`

Revoke an API key.

Authentication: session cookie only. API keys are refused.

**Responses**

- `200`: API key deleted.

## Data models

Request and response shapes these endpoints use: [ApiKey](https://docs.visualsentinel.com/reference/models/api-key.md).

Generated from the OpenAPI 3.1 specification at [https://docs.visualsentinel.com/openapi.json](https://docs.visualsentinel.com/openapi.json), the same file the interactive reference reads.