API
Management API
Everything the dashboard does, by API.
Everything the dashboard does is available at https://api.vallkey.com/_guard/v1 with your management token:
Create a key
curl https://api.vallkey.com/_guard/v1/keys \ -H "Authorization: Bearer $VALLKEY_TOKEN" \ -H "Content-Type: application/json" \ -d '{"provider":"stripe","real_key":"sk_test_...","label":"CI","rules":{"allow":[{"method":"GET","path":"/v1/**"}]}}'| Request | What it does |
|---|---|
POST /keys | Creates a ghost key: { provider, real_key, label?, rules? }. Returns the ghost key once. |
GET /keys | Lists your keys. |
GET /keys/:id | Rules, pending changes, today's usage and recent activity. |
PUT /keys/:id/rules | Replaces the rules. Answers { applied: "now" } or { applied: "scheduled", activatesAt }. |
POST /keys/:id/kill | Kills the key: { reason? }. |
POST /keys/:id/revive | Schedules the key to come back after the safety delay. |
DELETE /keys/:id | Deletes the key and destroys its encrypted real key. |
PUT /keys/:id/real-key, DELETE /keys/:id/real-key | Schedules a new real key { real_key }, or cancels the pending one. |
POST /keys/:id/rotate, DELETE /keys/:id/previous | Creates a new ghost key { grace_hours: 0 | 1 | 24 | 72 } and returns it once; or turns the old one off early. |
PUT /keys/:id/blocked-users | Blocks or unblocks one of your users on the key's short-lived keys: { "user": "user_4821", "blocked": true }. |
GET /keys/:id/activity, GET /keys/:id/activity.csv | Activity, newest first, paged with ?before=<id>&limit=; or all of it as CSV. |
GET /members, POST /invites, PUT /members/:id/role, DELETE /members/:id | Manages the team (owner only, except listing). |
GET /audit | The audit log, paged with ?before=<id>&limit=. |
GET /account/export, POST /account/delete | Exports your data, or deletes the account with { "confirm": "DELETE MY ACCOUNT" }. |
GET /passkeys, DELETE /passkeys/:id | Lists or removes passkeys, for example to recover a locked-out account. |
POST /token/rotate | Replaces your recovery token and returns the new one once. |
GET /tokens, POST /tokens, DELETE /tokens/:id | Lists, creates { name, scope: "read" | "admin" | "full" } or revokes API tokens (owner only). A new token is returned once. |
GET /billing | Your plan, its limits and this month's usage. |
GET /alerts, PUT /alerts | Reads or sets { webhook_url?, email_alerts? }. |
Still have a question?
We read every email, usually within a day.