Control Keys and Scopes

The enterprise owner's signed-in JWT issues and revokes control keys. A control key cannot issue another management key.


`POST /enterprise/control-keys`	Create a MANAGEMENT / PROVISIONING key
`GET /enterprise/control-keys`	List the owner's control-key metadata without secrets
`DELETE /enterprise/control-keys/{hash}`	Revoke a control key
`GET /enterprise/control-keys/{hash}/mcp-status`	Read its latest authenticated MCP read status

Create a read-only balance-monitoring key

Authenticate with the enterprise owner's Authorization: Bearer <USER_JWT>. Request fields use camelCase:

JSON

1{
2  "name": "billing-monitor",
3  "keyType": "MANAGEMENT",
4  "scopes": ["tenant:billing:read"]
5}

name and keyType are required. Optional fields: allowedIps (IP/CIDR list) and expiresAt (future ISO-8601 timestamp). Expiry defaults to 90 days and cannot exceed 365 days. Run credential creation only when you intentionally need a new key.

Success returns HTTP 201 with code: 200. data.apiKey is the full one-time secret and data.credential is metadata. Later lists do not reveal the secret. Use its returned hash, not the secret, for revocation and status paths.

Scope availability


`tenant:members:read` / `tenant:members:write`	Yes	Yes
`tenant:keys:read` / `tenant:keys:write`	Yes	Yes
`tenant:policies:read` / `tenant:policies:write`	Yes	No
`tenant:billing:read`	Yes	No
`tenant:audit:read`	Configurable	No

Omitted/empty scopes select the type's default set, including writes. Explicitly request billing read only for a monitoring key. A configurable scope does not imply that a matching REST endpoint exists; this page does not advertise an unpublished audit or charge-detail management API.

Control keys are accepted only under /enterprise/v1/** and /enterprise/mcp/**. They cannot be used for inference, /v1/key, /v1/billing/**, or signed-in management endpoints.