API Keys

Maintained by: Aether365 Team Audience: Developers Scope: API key management endpoints

API keys are used to authenticate requests to the REST API without a user session.

Each API key is bound to the tenant account that created it and acts with the account owner's permissions - it can read and write the tenant's data. Treat keys like passwords. API access requires a plan that includes it, and a tenant can have at most 10 keys.

INFO

Your first API key must be created in the dashboard under Settings > API Keys. After that, keys can also be managed through the endpoints below using an existing key.

List API Keys

Returns all active API keys for the tenant.

GET /tenants/me/api-keys

INFO

For security, the full key value is only returned once - at creation time. Subsequent list requests show only the key prefix and metadata.

Example Request

curl https://api.aether365.io/tenants/me/api-keys \
  -H "Authorization: Bearer ak_live_..."

Example Response

{
  "success": true,
  "data": [
    {
      "id": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d",
      "name": "CI pipeline",
      "keyPrefix": "ak_live_9f3c...b2d4",
      "msTenantId": null,
      "lastUsedAt": "2026-04-10T14:23:00+00:00",
      "createdAt": "2026-03-01T09:00:00+00:00"
    }
  ]
}

Response Fields

Field	Type	Description
id	string	Key identifier (UUID)
name	string	Display name
keyPrefix	string	First 12 and last 4 characters of the key (for identification)
msTenantId	string or null	Connected Microsoft tenant recorded for this key, if any
lastUsedAt	string or null	ISO 8601 timestamp of last authenticated request
createdAt	string	ISO 8601 timestamp

---

Create an API Key

Creates a new API key. The full key value is returned once and cannot be retrieved again.

POST /tenants/me/api-keys

Request Body

{
  "name": "CI pipeline"
}

Field	Type	Required	Description
name	string	Yes	Display name for the key (max 255 characters)
msTenantId	string	No	Must match one of your connected Microsoft tenants. Stored and shown as key metadata; requests still operate on the account's currently active connection

Example Request

curl -X POST https://api.aether365.io/tenants/me/api-keys \
  -H "Authorization: Bearer ak_live_..." \
  -H "Content-Type: application/json" \
  -d '{"name": "CI pipeline"}'

Example Response

Returns 201:

{
  "success": true,
  "data": {
    "id": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d",
    "name": "CI pipeline",
    "keyPrefix": "ak_live_9f3c...b2d4",
    "msTenantId": null,
    "key": "ak_live_examplekeyexamplekeyexamplekeyexamplekeyexamplekeyexamplekey",
    "createdAt": "2026-04-12T10:00:00+00:00"
  }
}

Store the key immediately

The key field is only returned in this response. It cannot be retrieved later. Store it in a secrets manager (GitHub Actions secrets, HashiCorp Vault, etc.) immediately.

---

Delete an API Key

Permanently revokes an API key. Any requests using this key will return 401 immediately.

DELETE /tenants/me/api-keys/{keyId}

Example Request

curl -X DELETE https://api.aether365.io/tenants/me/api-keys/a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d \
  -H "Authorization: Bearer ak_live_..."

Example Response

{
  "success": true,
  "data": null
}

---

Using an API Key

Pass the API key as a Bearer token in the Authorization header:

curl https://api.aether365.io/tenants/me/scans \
  -H "Authorization: Bearer ak_live_examplekeyexamplekeyexamplekeyexamplekeyexamplekeyexamplekey"

API keys do not expire, but you can rotate them by creating a new key and deleting the old one.

Limits

• A tenant can have at most 10 API keys; creating an 11th returns 400 VALIDATION_ERROR.
• Requests are throttled at the API gateway (roughly 100 requests per second with burst capacity of 500, not per key). Exceeding the throttle returns 429 Too Many Requests without a Retry-After header - retry with exponential backoff. See Rate Limits.