openapi: 3.1.0
info:
  title: Daytona admin api-keys API
  description: Daytona Admin API — admin, audit, config, runners, docker-registry, regions, object-storage, jobs operations on the Daytona AI platform.
  version: '1.0'
  contact:
    name: Daytona Platforms Inc.
    url: https://www.daytona.io
    email: support@daytona.com
  license:
    name: Apache-2.0
    url: https://www.apache.org/licenses/LICENSE-2.0
servers:
- url: https://app.daytona.io/api
  description: Daytona Cloud production API
tags:
- name: api-keys
paths:
  /api-keys:
    post:
      operationId: createApiKey
      parameters:
      - name: X-Daytona-Organization-ID
        in: header
        description: Use with JWT to specify the organization ID
        required: false
        schema:
          type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateApiKey'
      responses:
        '201':
          description: API key created successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiKeyResponse'
      security:
      - bearer: []
      - oauth2:
        - openid
        - profile
        - email
      summary: Create API key
      tags:
      - api-keys
    get:
      operationId: listApiKeys
      parameters:
      - name: X-Daytona-Organization-ID
        in: header
        description: Use with JWT to specify the organization ID
        required: false
        schema:
          type: string
      responses:
        '200':
          description: API keys retrieved successfully.
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/ApiKeyList'
        '500':
          description: Error fetching API keys.
      security:
      - bearer: []
      - oauth2:
        - openid
        - profile
        - email
      summary: List API keys
      tags:
      - api-keys
  /api-keys/current:
    get:
      operationId: getCurrentApiKey
      parameters:
      - name: X-Daytona-Organization-ID
        in: header
        description: Use with JWT to specify the organization ID
        required: false
        schema:
          type: string
      responses:
        '200':
          description: API key retrieved successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiKeyList'
      security:
      - bearer: []
      - oauth2:
        - openid
        - profile
        - email
      summary: Get current API key's details
      tags:
      - api-keys
  /api-keys/{name}:
    get:
      operationId: getApiKey
      parameters:
      - name: X-Daytona-Organization-ID
        in: header
        description: Use with JWT to specify the organization ID
        required: false
        schema:
          type: string
      - name: name
        required: true
        in: path
        schema:
          type: string
      responses:
        '200':
          description: API key retrieved successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiKeyList'
      security:
      - bearer: []
      - oauth2:
        - openid
        - profile
        - email
      summary: Get API key
      tags:
      - api-keys
    delete:
      operationId: deleteApiKey
      parameters:
      - name: X-Daytona-Organization-ID
        in: header
        description: Use with JWT to specify the organization ID
        required: false
        schema:
          type: string
      - name: name
        required: true
        in: path
        schema:
          type: string
      responses:
        '204':
          description: API key deleted successfully.
      security:
      - bearer: []
      - oauth2:
        - openid
        - profile
        - email
      summary: Delete API key
      tags:
      - api-keys
  /api-keys/{userId}/{name}:
    delete:
      operationId: deleteApiKeyForUser
      parameters:
      - name: X-Daytona-Organization-ID
        in: header
        description: Use with JWT to specify the organization ID
        required: false
        schema:
          type: string
      - name: userId
        required: true
        in: path
        schema:
          type: string
      - name: name
        required: true
        in: path
        schema:
          type: string
      responses:
        '204':
          description: API key deleted successfully.
      security:
      - bearer: []
      - oauth2:
        - openid
        - profile
        - email
      summary: Delete API key for user
      tags:
      - api-keys
components:
  schemas:
    ApiKeyResponse:
      type: object
      properties:
        name:
          type: string
          description: The name of the API key
          example: My API Key
        value:
          type: string
          description: The API key value
          example: bb_sk_1234567890abcdef
        createdAt:
          format: date-time
          type: string
          description: When the API key was created
          example: '2024-03-14T12:00:00.000Z'
        permissions:
          type: array
          description: The list of organization resource permissions assigned to the API key
          items:
            type: string
            enum:
            - write:registries
            - delete:registries
            - write:snapshots
            - delete:snapshots
            - write:sandboxes
            - delete:sandboxes
            - read:volumes
            - write:volumes
            - delete:volumes
            - write:regions
            - delete:regions
            - read:runners
            - write:runners
            - delete:runners
            - read:audit_logs
        expiresAt:
          format: date-time
          type: string
          description: When the API key expires
          example: '2025-06-09T12:00:00.000Z'
          nullable: true
      required:
      - name
      - value
      - createdAt
      - permissions
      - expiresAt
    ApiKeyList:
      type: object
      properties:
        name:
          type: string
          description: The name of the API key
          example: My API Key
        value:
          type: string
          description: The masked API key value
          example: bb_********************def
        createdAt:
          format: date-time
          type: string
          description: When the API key was created
          example: '2024-03-14T12:00:00.000Z'
        permissions:
          type: array
          description: The list of organization resource permissions assigned to the API key
          items:
            type: string
            enum:
            - write:registries
            - delete:registries
            - write:snapshots
            - delete:snapshots
            - write:sandboxes
            - delete:sandboxes
            - read:volumes
            - write:volumes
            - delete:volumes
            - write:regions
            - delete:regions
            - read:runners
            - write:runners
            - delete:runners
            - read:audit_logs
        lastUsedAt:
          format: date-time
          type: string
          description: When the API key was last used
          example: '2024-03-14T12:00:00.000Z'
          nullable: true
        expiresAt:
          format: date-time
          type: string
          description: When the API key expires
          example: '2024-03-14T12:00:00.000Z'
          nullable: true
        userId:
          type: string
          description: The user ID of the user who created the API key
          example: '123'
      required:
      - name
      - value
      - createdAt
      - permissions
      - lastUsedAt
      - expiresAt
      - userId
    CreateApiKey:
      type: object
      properties:
        name:
          type: string
          description: The name of the API key
          example: My API Key
        permissions:
          type: array
          description: The list of organization resource permissions explicitly assigned to the API key
          items:
            type: string
            enum:
            - write:registries
            - delete:registries
            - write:snapshots
            - delete:snapshots
            - write:sandboxes
            - delete:sandboxes
            - read:volumes
            - write:volumes
            - delete:volumes
            - write:regions
            - delete:regions
            - read:runners
            - write:runners
            - delete:runners
            - read:audit_logs
        expiresAt:
          format: date-time
          type: string
          description: When the API key expires
          example: '2025-06-09T12:00:00.000Z'
          nullable: true
      required:
      - name
      - permissions
  securitySchemes:
    bearer:
      scheme: bearer
      bearerFormat: JWT
      type: http
      description: API Key access
    oauth2:
      type: openIdConnect
      openIdConnectUrl: http://localhost:3000/.well-known/openid-configuration