Keys, teams, policies, grants

Org-admin endpoints for managing access, conflict resolution, and team membership.

API keys

Path: /v1/keys


GET    /v1/keys                  List org's API keys (returns metadata, not secrets)
POST   /v1/keys                  Create new key. Body: { name, tier?, scopedAgent?, scopedScope? }.
                                 Response includes `key` — shown ONCE, store it.
DELETE /v1/keys/:id              Revoke a key

Key tiers map to the rate-limit + ops quota at the metering layer (developer / team / scale / enterprise).

Scoped keys let you restrict a key to a single agentId + scope, useful for handing keys to individual agents.

Teams

Path: /v1/teams


GET    /v1/teams                 List teams in the org
POST   /v1/teams                 Body: { name }
DELETE /v1/teams/:id             Delete a team

In v1, teams are namespaces — they group agents but don’t yet drive visibility. Future versions will tie scope='team' to team membership.

Conflict policies

Path: /v1/policies


GET    /v1/policies              List configured policies (one per workflow + one org default)
PUT    /v1/policies              Body: { policy, workflowId?, webhookUrl? }
                                 workflowId omitted = org-wide default
DELETE /v1/policies/:id          Remove a policy

policy is one of ignore | planner_wins | timestamp_wins | human_in_loop. See Conflict policies for what each does.

Access grants

Path: /v1/grants


GET    /v1/grants                List grants for the org
POST   /v1/grants                Body: { grantorRole, granteeAgent, resourceScope, validTo? }
DELETE /v1/grants/:id            Revoke a grant

See Access grants for the visibility model.