# ApiKeys

> Tracon documentation. Tracon is a .NET package family that adds a control
> plane on Microsoft Agent Framework, published as NuGet packages that run
> inside your own ASP.NET Core application.
>
> Page: https://tracon.dev/http-api/apikeys/
> Summary: The apikeys endpoints of the Tracon HTTP API — 3 operations.

3 operations. `{prefix}` is the route prefix passed to
`MapTracon`; the template uses `/tracon`.

## GET {prefix}/api/api-keys

**Operation ID:** `TraconListApiKeys`

**Lists a tenant's API keys.**

The response carries neither the raw value nor a hash.

**Authorization:** bearer authentication; `Admin` role policy when that policy is registered; `SecurityAdmin` API-key scope.

| Response | Body | Headers |
|---|---|---|
| **200** OK | `application/json` → array of [`ApiKeyRecord`](/http-api/schemas/apikeyrecord/) | — |

## POST {prefix}/api/api-keys

**Operation ID:** `TraconCreateApiKey`

**Generates a new API key.**

The raw value is returned in the response ONLY ON THIS CALL and cannot be produced again. The scope list is closed; an unknown scope is rejected. If the request was authenticated with an API key, a scope that key does NOT ITSELF CARRY cannot be requested (privilege extension/attenuation). A key with the PlatformAdmin scope reaches every tenant, so requesting it needs platform authority (403 otherwise).

**Authorization:** bearer authentication; `Admin` role policy when that policy is registered; `SecurityAdmin` API-key scope.

**Request body** (required):

- `application/json` → [`ApiKeyCreateRequest`](/http-api/schemas/apikeycreaterequest/)

| Response | Body | Headers |
|---|---|---|
| **200** OK | `application/json` → [`ApiKeyCreationResult`](/http-api/schemas/apikeycreationresult/) | — |

## DELETE {prefix}/api/api-keys/{id}

**Operation ID:** `TraconRevokeApiKey`

**Revokes a key.**

The row is NOT deleted; a revocation timestamp is written and stays in the audit trail.

**Authorization:** bearer authentication; `Admin` role policy when that policy is registered; `SecurityAdmin` API-key scope.

| Parameter | In | Required | Type | Description and rules |
|---|---|---|---|---|
| `id` | path | yes | `string (uuid)` | — |

| Response | Body | Headers |
|---|---|---|
| **204** No Content | — | — |