openapi: 3.2.0
info:
  title: Latitude API Keys API
  version: v1
  description: Open-source AI agent monitoring platform. Full observability into what's failing in production. Discover underlying issues, get alerts when something breaks and verify your fix worked.
  servers:
  - url: https://api.latitude.so
    description: Production
servers:
- url: https://api.latitude.so
tags:
- name: API Keys
paths:
  /v1/api-keys:
    post:
      tags:
      - API Keys
      x-fern-sdk-group-name: apiKeys
      x-fern-sdk-method-name: create
      summary: Generate API key
      description: Generates a new API key. Omit projectId and projectSlug for an organization-wide key, or pass either to bind the key to one project. The token is only returned once — store it securely.
      security:
      - ApiKeyAuth: []
      operationId: createApiKey
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateApiKeyBody'
      responses:
        '201':
          description: API key generated
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiKey'
        '400':
          description: Validation error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: Not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    get:
      tags:
      - API Keys
      x-fern-sdk-group-name: apiKeys
      x-fern-sdk-method-name: list
      summary: List API keys
      description: Returns all API keys for the organization. Tokens are not included in the list response.
      security:
      - ApiKeyAuth: []
      operationId: listApiKeys
      responses:
        '200':
          description: List of API keys
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiKeyList'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /v1/api-keys/{apiKeyId}:
    get:
      tags:
      - API Keys
      x-fern-sdk-group-name: apiKeys
      x-fern-sdk-method-name: get
      summary: Get API key
      description: Returns a single API key including the full unmasked `token`. Useful for retrieving a stored token by id without rotating it.
      security:
      - ApiKeyAuth: []
      operationId: getApiKey
      parameters:
      - schema:
          type: string
          minLength: 1
          description: API-key identifier.
        required: true
        description: API-key identifier.
        name: apiKeyId
        in: path
      responses:
        '200':
          description: API key
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiKey'
        '400':
          description: Validation error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: Not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    patch:
      tags:
      - API Keys
      x-fern-sdk-group-name: apiKeys
      x-fern-sdk-method-name: update
      summary: Update API key
      description: Renames an API key. The token itself is immutable — use create + revoke if you need a new value.
      security:
      - ApiKeyAuth: []
      operationId: updateApiKey
      parameters:
      - schema:
          type: string
          minLength: 1
          description: API-key identifier.
        required: true
        description: API-key identifier.
        name: apiKeyId
        in: path
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateApiKeyBody'
      responses:
        '200':
          description: API key updated
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiKey'
        '400':
          description: Validation error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: Not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    delete:
      tags:
      - API Keys
      x-fern-sdk-group-name: apiKeys
      x-fern-sdk-method-name: revoke
      summary: Revoke API key
      description: Revokes an API key.
      security:
      - ApiKeyAuth: []
      operationId: revokeApiKey
      parameters:
      - schema:
          type: string
          minLength: 1
          description: API-key identifier.
        required: true
        description: API-key identifier.
        name: apiKeyId
        in: path
      responses:
        '204':
          description: API key revoked
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: Not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
components:
  schemas:
    CreateApiKeyBody:
      type: object
      properties:
        name:
          type: string
          minLength: 1
          description: Human-readable name for the API key. Used to distinguish keys in the UI.
        projectId:
          type: string
          minLength: 1
          description: Bind the key to this project. Omit `projectId` and `projectSlug` to mint an organization-wide key. One project per key.
        projectSlug:
          type: string
          minLength: 1
          description: Bind the key to the project with this slug. Must agree with `projectId` when both are set.
      required:
      - name
    Error:
      type: object
      properties:
        error:
          type: string
      required:
      - error
    ApiKey:
      type: object
      properties:
        id:
          type: string
          description: Stable API-key identifier.
        organizationId:
          type: string
          description: Organization that owns this API key.
        scope:
          type: string
          enum:
          - organization
          - project
          description: '`organization` keys can call every route. `project` keys are bound to `projectId`.'
        projectId:
          type: string
          nullable: true
          description: Project this key is bound to. `null` for an organization-wide key.
        projectSlug:
          type: string
          nullable: true
          description: Slug of the bound project, when the project still exists. `null` for organization-wide keys.
        name:
          type: string
          description: Human-readable name.
        token:
          type: string
          description: The full API key token. Returned by create / get / update — store it securely; treat it as a password.
        lastUsedAt:
          type: string
          nullable: true
          description: ISO-8601 timestamp of the most recent successful authentication. `null` until first use.
        deletedAt:
          type: string
          nullable: true
          description: ISO-8601 timestamp at which the key was revoked. `null` while the key is active.
        createdAt:
          type: string
          description: ISO-8601 timestamp of creation.
        updatedAt:
          type: string
          description: ISO-8601 timestamp of the last metadata update (rename, revoke, last-used touch).
      required:
      - id
      - organizationId
      - scope
      - projectId
      - projectSlug
      - name
      - token
      - lastUsedAt
      - deletedAt
      - createdAt
      - updatedAt
    ApiKeyListItem:
      type: object
      properties:
        id:
          type: string
          description: Stable API-key identifier.
        organizationId:
          type: string
          description: Organization that owns this API key.
        scope:
          type: string
          enum:
          - organization
          - project
          description: '`organization` keys can call every route. `project` keys are bound to `projectId`.'
        projectId:
          type: string
          nullable: true
          description: Project this key is bound to. `null` for an organization-wide key.
        projectSlug:
          type: string
          nullable: true
          description: Slug of the bound project, when the project still exists. `null` for organization-wide keys.
        name:
          type: string
          description: Human-readable name.
        token:
          type: string
          description: Masked token preview safe to display in lists. Use `GET /api-keys/{apiKeyId}` to retrieve the full token.
        lastUsedAt:
          type: string
          nullable: true
          description: ISO-8601 timestamp of the most recent successful authentication. `null` until first use.
        deletedAt:
          type: string
          nullable: true
          description: ISO-8601 timestamp at which the key was revoked. `null` while the key is active.
        createdAt:
          type: string
          description: ISO-8601 timestamp of creation.
        updatedAt:
          type: string
          description: ISO-8601 timestamp of the last metadata update.
      required:
      - id
      - organizationId
      - scope
      - projectId
      - projectSlug
      - name
      - token
      - lastUsedAt
      - deletedAt
      - createdAt
      - updatedAt
    ApiKeyList:
      type: object
      properties:
        apiKeys:
          type: array
          items:
            $ref: '#/components/schemas/ApiKeyListItem'
      required:
      - apiKeys
    UpdateApiKeyBody:
      type: object
      properties:
        name:
          type: string
          minLength: 1
          description: New human-readable name for the API key.
      required:
      - name
  securitySchemes:
    ApiKeyAuth:
      type: http
      scheme: bearer
      bearerFormat: API key
      description: 'Organization-scoped API key, sent as `Authorization: Bearer <key>`.'
      x-fern-bearer:
        name: apiKey
        env: LATITUDE_API_KEY