openapi: 3.2.0
info:
  title: AutoContent Platform API Keys API
  version: 1.0.0
  description: First-class content Assets with prepaid USD billing. Generic document and video routes do not exist.
servers:
- url: https://api.autocontentapi.com/v1
tags:
- name: API Keys
paths:
  /api-keys:
    post:
      operationId: createApiKey
      summary: Create a scoped Platform API key
      tags:
      - API Keys
      security:
      - platformOAuth: []
      x-required-scopes:
      - platform.keys.write
      x-principal: oauth
      x-idempotency-required: true
      parameters:
      - name: Idempotency-Key
        in: header
        required: true
        description: 1–255 visible ASCII bytes; UUID recommended.
        schema:
          type: string
          minLength: 1
          maxLength: 255
          pattern: ^[!-~]+$
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                name:
                  type: string
                  minLength: 1
                  maxLength: 80
                  x-max-utf8-bytes: 80
                scopes:
                  minItems: 1
                  maxItems: 4
                  type: array
                  items:
                    type: string
                    enum:
                    - platform.read
                    - platform.write
                    - platform.generate
                    - platform.billing.read
              required:
              - name
              - scopes
              additionalProperties: false
      responses:
        '201':
          description: Successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiKey'
        default:
          $ref: '#/components/responses/AutoContentError'
    get:
      operationId: listApiKeys
      summary: List Platform API key metadata
      tags:
      - API Keys
      security:
      - platformOAuth: []
      x-required-scopes:
      - platform.keys.write
      x-principal: oauth
      x-idempotency-required: false
      parameters:
      - name: cursor
        in: query
        required: false
        schema:
          type: string
          minLength: 1
          maxLength: 4096
      - name: limit
        in: query
        required: false
        schema:
          type: string
          pattern: ^(?:[1-9]|[1-9][0-9]|100)$
      responses:
        '200':
          description: Successful response.
          content:
            application/json:
              schema:
                type: object
                additionalProperties: false
                required:
                - data
                - next_cursor
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/ApiKey'
                  next_cursor:
                    oneOf:
                    - type: string
                      minLength: 1
                    - type: 'null'
        default:
          $ref: '#/components/responses/AutoContentError'
  /api-keys/{id}:
    delete:
      operationId: revokeApiKey
      summary: Revoke a Platform API key
      tags:
      - API Keys
      security:
      - platformOAuth: []
      x-required-scopes:
      - platform.keys.write
      x-principal: oauth
      x-idempotency-required: false
      parameters:
      - name: id
        in: path
        required: true
        schema:
          type: string
          pattern: ^key_[A-Za-z0-9_-]+$
      responses:
        '200':
          description: Successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiKeyRevocation'
        default:
          $ref: '#/components/responses/AutoContentError'
components:
  schemas:
    ErrorEnvelope:
      type: object
      additionalProperties: false
      required:
      - error
      properties:
        error:
          $ref: '#/components/schemas/ErrorBody'
    ErrorBody:
      type: object
      additionalProperties: false
      required:
      - code
      - message
      - correlation_id
      - doc_url
      properties:
        code:
          type: string
          enum:
          - invalid_request
          - unknown_asset_type
          - invalid_asset_options
          - invalid_model_options
          - model_not_supported
          - model_retired
          - project_not_ready
          - project_limit_exceeded
          - provider_operation_limit_exceeded
          - source_not_ready
          - source_unreachable
          - source_paywalled
          - product_visual_required
          - no_qualified_trend
          - no_qualified_knowledge
          - input_resolution_failed
          - max_cost_exceeded
          - payment_required
          - content_loop_budget_exceeded
          - content_loop_limit_exceeded
          - idempotency_conflict
          - idempotency_in_progress
          - consent_required
          - voice_not_found
          - voice_not_ready
          - voice_not_supported
          - avatar_not_found
          - avatar_not_ready
          - avatar_not_supported
          - artifact_verification_failed
          - rate_limited
          - webhook_limit_exceeded
          - not_found
          - unauthorized
          - forbidden
          - internal_error
        message:
          type: string
        details:
          oneOf:
          - type: array
            items:
              $ref: '#/components/schemas/ErrorDetail'
          - type: object
        correlation_id:
          type: string
          pattern: ^corr_[A-Za-z0-9_-]+$
        doc_url:
          type: string
          format: uri
    ApiKey:
      type: object
      additionalProperties: false
      required:
      - id
      - prefix
      - name
      - scopes
      - created_at
      properties:
        id:
          type: string
          pattern: ^key_[A-Za-z0-9_-]+$
        prefix:
          type: string
          minLength: 1
        name:
          type: string
          minLength: 1
          maxLength: 80
        scopes:
          type: array
          uniqueItems: true
          items:
            type: string
        created_at:
          type: string
          format: date-time
        last_used_at:
          oneOf:
          - type: string
            format: date-time
          - type: 'null'
        secret:
          oneOf:
          - type: string
            pattern: ^acp_
          - type: 'null'
        secret_unavailable:
          type: boolean
        rotate_guidance:
          oneOf:
          - type: string
            minLength: 1
          - type: 'null'
    ApiKeyRevocation:
      type: object
      additionalProperties: false
      required:
      - id
      - revoked_at
      properties:
        id:
          type: string
          pattern: ^key_[A-Za-z0-9_-]+$
        revoked_at:
          type: string
          format: date-time
    ErrorDetail:
      type: object
      additionalProperties: false
      required:
      - reason
      properties:
        field:
          type: string
        reason:
          type: string
  responses:
    AutoContentError:
      description: Normalized AutoContent error; provider payloads are never returned.
      headers:
        Retry-After:
          description: Whole seconds before retry when the error supplies a bounded retry time.
          schema:
            type: integer
            minimum: 1
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorEnvelope'
          example:
            error:
              code: max_cost_exceeded
              message: Current price exceeds max_cost_usd.
              correlation_id: corr_42
              doc_url: https://docs.autocontentapi.com/errors/max-cost-exceeded
  securitySchemes:
    platformOAuth:
      type: http
      scheme: bearer
      bearerFormat: Platform OAuth JWT
    platformApiKey:
      type: http
      scheme: bearer
      bearerFormat: acp_ Platform API key