Keys and webhooks
The credentials and endpoints this workspace has issued.
Keys and webhooks tools
| Tool | What it does |
|---|---|
| listApiKeys | Every API key this workspace has issued, what it may do and what it may send as, in a masked form that is enough to tell two keys apart and nothing more. |
| rotateApiKey | Give a key a new secret, keeping its id, name, scopes, role and send scope. There is no overlap window, and the new secret is shown once. |
| setApiKeyEnabled | Switch a key off, or back on. This is the reversible one: the key keeps its secret, its scopes, its role and its send scope. |
| revokeApiKey | Revoke a key permanently. A revoked key can never be switched back on, rotated or changed. |
| setApiKeySendScope | Say which addresses a key may send as, as two independent lists. What you pass REPLACES what the key had. |
| listWebhooks | Every webhook endpoint this workspace has, where it posts, whether it is enabled and which events it asked for. Signing secrets are never shown. |
| listWebhookEvents | Every event an endpoint can subscribe to, grouped by family, with a line saying when each one fires. |
A secret is shown once, when the key is made or rotated, and nothing recovers it afterwards. rotateApiKey is the only tool here that returns one, so whatever holds the old secret has to be handed the replacement before it next runs.
Reach for setApiKeyEnabled before revokeApiKey. Switching a key off is reversible and tells you whether anything still depends on it; revoking is permanent and the only way forward from it is a new key and a new secret.
There is no createApiKey and no createWebhook here, for the same reason there is no createRole: issuing a credential from inside a chat window is a quiet, wide change nobody sees afterwards. Both are in Settings, where whoever is doing it can see what they are handing out.