Create Retriever API Key

Generate a scoped API key for executing this specific retriever.

Use Cases:

• Provide external services with execution-only access
• Embed retriever calls in customer applications
• Create separate keys for staging vs production
• Implement per-customer access keys for SaaS products

Security:

• Keys grant EXECUTE_RETRIEVER permission only
• Keys are scoped to single retriever (cannot access others)
• Keys inherit org’s rate limits
• Keys can be revoked instantly
• Key prefix (ret_sk_abc…) shown in UI for identification

Ownership:

• Only the organization that owns the retriever can create keys
• Verified by matching internal_id + namespace_id

Key Format:

• Prefix: ret_sk_
• Length: 60 characters
• Example: ret_sk_abcdefghijklmnopqrstuvwxyz123456789…

Response:

• Plaintext key shown ONLY ONCE in response
• Save the key immediately - it cannot be retrieved later
• Key prefix stored for identification in UI

POST /v1/retrievers/{retriever_id}/api-keys

Create Retriever API Key

cURL

curl --request POST \
  --url https://api.mixpeek.com/v1/retrievers/{retriever_id}/api-keys \
  --header 'Content-Type: application/json' \
  --data '
{
  "name": "<string>",
  "description": "<string>",
  "expires_at": "2023-11-07T05:31:56Z",
  "allowed_origins": [
    "https://docs.example.com",
    "https://*.example.com"
  ]
}
'

201

{
  "key_hash": "<string>",
  "internal_id": "<string>",
  "user_id": "<string>",
  "name": "<string>",
  "key": "<string>",
  "key_id": "<string>",
  "key_prefix": "sk_abc123...",
  "key_type": "standard",
  "subscription_id": "<string>",
  "organization_id": "<string>",
  "description": "",
  "permissions": [],
  "scopes": [
    {
      "resource_id": "<string>",
      "operations": []
    }
  ],
  "rate_limit_override": 123,
  "status": "active",
  "expires_at": "2023-11-07T05:31:56Z",
  "last_used_at": "2023-11-07T05:31:56Z",
  "created_at": "2023-11-07T05:31:56Z",
  "created_by": "<string>",
  "revoked_at": "2023-11-07T05:31:56Z",
  "revoked_by": "<string>",
  "allowed_origins": [
    "https://docs.example.com",
    "https://*.example.com"
  ],
  "principal_id": "<string>"
}

Headers

Authorization · string

REQUIRED: Bearer token authentication using your API key. Format: 'Bearer sk_xxxxxxxxxxxxx'. You can create API keys in the Mixpeek dashboard under Organization Settings.

Examples:

"Bearer YOUR_API_KEY"

"Bearer YOUR_STRIPE_API_KEY"

authorization · string

X-Namespace · string

Namespace identifier for scoping this request. All resources (collections, buckets, taxonomies, etc.) are scoped to a namespace. You can provide either the namespace name or namespace ID. Format: ns_xxxxxxxxxxxxx (ID) or a custom name like 'my-namespace'. Falls back to ?namespace= query parameter if the header is omitted.

Examples:

"ns_abc123def456"

"production"

"my-namespace"

Path Parameters

retriever_id · string · required

Body

application/json

Request payload for creating a retriever-scoped API key.

Retriever keys are automatically scoped to execute a specific retriever. The scope and permissions are auto-populated by the service layer and cannot be modified.

Example: { "name": "production-api", "description": "Production API key for customer integrations", "expires_at": "2026-12-31T23:59:59Z" }

name · string · required

Human-friendly key label for identification.

Required string length: 1 - 100

description · string | null

Optional description explaining the key's purpose.

Maximum string length: 500

expires_at · string<date-time> | null

Optional UTC timestamp when the key automatically expires.

allowed_origins · string[] | null

Optional list of allowed HTTP origins for this API key. When set, browser requests must include a matching Origin header. Supports exact matches and wildcard subdomains (e.g., 'https://*.example.com'). Defense-in-depth: Origin headers can be spoofed from non-browser contexts.

Example:

[
  "https://docs.example.com",
  "https://*.example.com"
]

Response

201

application/json

Successful Response

Response model including the plaintext key (shown only once).

This response is returned immediately after key creation. The plaintext key is shown ONLY in this response and cannot be retrieved later. Users should save the key immediately for secure storage.

Security note: The key field contains the plaintext secret and should be: - Stored securely by the user (environment variables, secrets manager) - Never committed to version control - Never logged or exposed in error messages - Rotated/revoked if accidentally exposed

key_hash · string · required

SHA-256 hash of the plaintext key.

internal_id · string · required

Organization internal identifier.

user_id · string · required

Identifier of the user who owns the key.

name · string · required

Human-friendly key label.

key · string · required

Plaintext API key (shown only once). Prefix: ret_sk_. Store securely immediately after creation.

key_id · string

Public identifier for the API key.

key_prefix · string | null

Visible prefix of the API key for user identification (e.g., 'sk_abc123...'). Shows the first 10 characters of the plaintext key to help users identify which key is which in lists, without exposing the full secret. This follows industry best practices from GitHub, Stripe, and AWS. Generated automatically for new keys. Older keys may not have this field.

Required string length: 10 - 13

Example:

"sk_abc123..."

key_type · enum<string> · default: standard

Type of API key. STANDARD for regular organization keys, MARKETPLACE_SUBSCRIPTION for marketplace subscription access tokens.

Available options: standard, marketplace_subscription, retriever, user_scoped, session

subscription_id · string | null

Marketplace subscription ID if this is a marketplace subscription key. Only set when key_type is MARKETPLACE_SUBSCRIPTION.

organization_id · string | null

Organization public identifier (denormalized).

description · string · default: ""

Optional description explaining the key usage.

permissions · enum<string>[]

Permissions granted to the key.

Simplified API key permissions.

This four-value enum replaces the legacy 16-permission model. Keep usage simple: prefer the least privileged option that satisfies the workflow.

Hierarchy (strongest -> weakest): ADMIN > DELETE > WRITE > READ.

Available options: read, write, delete, admin

scopes · ResourceScope · object[]

Resource-level scopes restricting the key.

Show child attributes

rate_limit_override · integer | null

Optional per-key rate limit override in requests per minute.

status · enum<string> · default: active

Lifecycle status of the key (active, revoked, expired).

Available options: active, revoked, expired

expires_at · string<date-time> | null

UTC timestamp when the key automatically expires.

last_used_at · string<date-time> | null

UTC timestamp of the last successful request using the key.

created_at · string<date-time>

UTC timestamp when the key was created.

created_by · string | null

User identifier that created the key.

revoked_at · string<date-time> | null

UTC timestamp when the key was revoked (if applicable).

revoked_by · string | null

User identifier that revoked the key (if applicable).

allowed_origins · string[] | null

Optional list of allowed HTTP origins for this API key. When set, requests must include an Origin header matching one of these values. Supports exact matches (e.g., 'https://docs.example.com') and wildcard subdomains (e.g., 'https://*.example.com'). Only enforced for browser requests (defense-in-depth, not a security boundary). Null means no origin restriction.

Example:

[
  "https://docs.example.com",
  "https://*.example.com"
]

principal_id · string | null

End-user identifier for document-level ACL (row-level security). When set, this key is user-scoped: all document reads are automatically filtered to documents the principal owns or has been granted access to. This represents an end-user in your application, NOT an org user.