Managing credentials
Issue, rotate and revoke keys, and trace everything a credential did.
Issue
curl -X POST "$SPARQ_API_URL/v1/admin/credentials" \
-H "Authorization: Bearer $SPARQ_KEY" -H "Content-Type: application/json" \
-d '{
"type": "project_api_key",
"owner": { "kind": "team", "name": "Support platform team", "contact": "platform@example.com" },
"project_id": "'$PROJECT_ID'",
"environment": "prod",
"purpose": "Back-end calls to /v1/runs",
"expires_at": "2027-10-28T00:00:00Z"
}'owner and purpose are required: every key has a named owner and a reason to exist. The response
is a CredentialIssued object; secret appears only in this response.
List and inspect
curl "$SPARQ_API_URL/v1/admin/credentials?project_id=$PROJECT_ID&status=active" \
-H "Authorization: Bearer $SPARQ_KEY"Rotate
Rotation issues a successor key, links it to its predecessor and carries the predecessor's grants to it. There is no overlap window, so deploy the new key promptly.
curl -X POST "$SPARQ_API_URL/v1/admin/credentials/$CREDENTIAL_ID/rotate" \
-H "Authorization: Bearer $SPARQ_KEY"Revoke
curl -X POST "$SPARQ_API_URL/v1/admin/credentials/$CREDENTIAL_ID/revoke" \
-H "Authorization: Bearer $SPARQ_KEY" -H "Content-Type: application/json" \
-d '{ "reason": "Key exposed in a build log" }'Trace a credential
Every request, cost row and audit record names the credential that caused it.
curl "$SPARQ_API_URL/v1/admin/audit?credential_id=$CREDENTIAL_ID" -H "Authorization: Bearer $SPARQ_KEY"
curl "$SPARQ_API_URL/v1/admin/usage?credential_id=$CREDENTIAL_ID" -H "Authorization: Bearer $SPARQ_KEY"