VindexDocs
    Vindex docs
    Dashboardgetvindex.com

    API reference

    Keys

    Create, list and revoke API keys.

    List API keys

    GET/v1/keys

    Request

    cURL
    curl "https://api.getvindex.com/v1/keys" \
  -H "Authorization: Bearer $VINDEX_KEY"

    Response 200

    Every key of the tenant, revoked ones included. Never the key itself.

    Example
    {
  "data": [
    {
      "id": "key_3f2a0c9e8b7d4c6a9f1e2d3c4b5a6978",
      "prefix": "vx_live_3f2a",
      "mode": "test",
      "label": "ci",
      "created_at": "2026-09-17T08:51:06.000Z",
      "last_used_at": null,
      "revoked_at": null
    }
  ]
}

    Errors

    • 400Invalid request (malformed JSON, or the body/query failed validation).
    • 401Missing, malformed, unknown or revoked API key.
    • 429Rate limit exceeded for this API key. See Retry-After.

    Create an API key

    POST/v1/keys

    Returns the full key once; only its SHA-256 hash is stored. An API key creates test-mode keys; live keys are made in the dashboard.

    Body

    • mode"live" | "test"required
    • labelstring

      ≤ 120 chars

    Request

    cURL
    curl -X POST "https://api.getvindex.com/v1/keys" \
  -H "Authorization: Bearer $VINDEX_KEY" \
  -H "Content-Type: application/json" \
  -d '{"mode":"test","label":"ci"}'

    Response 201

    Created. Store key now: it is never shown again.

    Example
    {
  "id": "key_3f2a0c9e8b7d4c6a9f1e2d3c4b5a6978",
  "prefix": "vx_live_3f2a",
  "mode": "test",
  "label": "ci",
  "created_at": "2026-09-17T08:51:06.000Z",
  "last_used_at": null,
  "revoked_at": null,
  "key": "vx_test_4f1c0d2e9b8a7c6d5e4f3a2b1c0d9e8f7a6b5c4d"
}

    Errors

    • 400Invalid request (malformed JSON, or the body/query failed validation).
    • 401Missing, malformed, unknown or revoked API key.
    • 402The workspace's plan has ended, so it's read-only (subscription_inactive). Revoking keys still works.
    • 403A test-mode key tried to create a live key (test_key_forbidden), or a live key did: live keys are made in the dashboard (dashboard_only).
    • 429Rate limit exceeded for this API key. See Retry-After.

    Revoke an API key

    DELETE/v1/keys/{id}

    Idempotent. Takes effect everywhere within about two minutes (the key's auth cache entry is deleted, KV is eventually consistent, and cached lookups expire after 60 s). You can't revoke the key making the request.

    Parameters

    • idstringpathrequired

      API key id 1–64 chars

    Request

    cURL
    curl -X DELETE "https://api.getvindex.com/v1/keys/$KEY_ID" \
  -H "Authorization: Bearer $VINDEX_KEY"

    Response 200

    The revoked key.

    Example
    {
  "id": "key_3f2a0c9e8b7d4c6a9f1e2d3c4b5a6978",
  "prefix": "vx_live_3f2a",
  "mode": "test",
  "label": "ci",
  "created_at": "2026-09-17T08:51:06.000Z",
  "last_used_at": null,
  "revoked_at": null
}

    Errors

    • 400Invalid request (malformed JSON, or the body/query failed validation).
    • 401Missing, malformed, unknown or revoked API key.
    • 403A test-mode key tried to revoke a live key (test_key_forbidden).
    • 404No such key for this tenant.
    • 409The key making the request can't revoke itself (cannot_revoke_current_key).
    • 429Rate limit exceeded for this API key. See Retry-After.