Get BYOK key

import requests

url = "https://api.auriko.ai/v1/workspaces/{workspace_id}/byok-keys/{byok_key_id}"

headers = {"Authorization": "Bearer <token>"}

response = requests.get(url, headers=headers)

print(response.text)

const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://api.auriko.ai/v1/workspaces/{workspace_id}/byok-keys/{byok_key_id}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

curl --request GET \
  --url https://api.auriko.ai/v1/workspaces/{workspace_id}/byok-keys/{byok_key_id} \
  --header 'Authorization: Bearer <token>'

{
  "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "workspace_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "provider": "<string>",
  "name": "<string>",
  "key_prefix": "<string>",
  "is_default": true,
  "disabled": true,
  "created_at": "2023-11-07T05:31:56Z",
  "updated_at": "2023-11-07T05:31:56Z",
  "account_tier": "<string>",
  "last_validated_at": "2023-11-07T05:31:56Z"
}

{
  "error": {
    "message": "API key is invalid.",
    "type": "authentication_error",
    "param": null,
    "code": "invalid_api_key"
  }
}

{
  "error": {
    "message": "The requested resource was not found.",
    "type": "not_found_error",
    "param": null,
    "code": "resource_not_found"
  }
}

GET

workspaces

{workspace_id}

byok-keys

{byok_key_id}

Get BYOK key

import requests

url = "https://api.auriko.ai/v1/workspaces/{workspace_id}/byok-keys/{byok_key_id}"

headers = {"Authorization": "Bearer <token>"}

response = requests.get(url, headers=headers)

print(response.text)

const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://api.auriko.ai/v1/workspaces/{workspace_id}/byok-keys/{byok_key_id}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

curl --request GET \
  --url https://api.auriko.ai/v1/workspaces/{workspace_id}/byok-keys/{byok_key_id} \
  --header 'Authorization: Bearer <token>'

{
  "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "workspace_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "provider": "<string>",
  "name": "<string>",
  "key_prefix": "<string>",
  "is_default": true,
  "disabled": true,
  "created_at": "2023-11-07T05:31:56Z",
  "updated_at": "2023-11-07T05:31:56Z",
  "account_tier": "<string>",
  "last_validated_at": "2023-11-07T05:31:56Z"
}

{
  "error": {
    "message": "API key is invalid.",
    "type": "authentication_error",
    "param": null,
    "code": "invalid_api_key"
  }
}

{
  "error": {
    "message": "The requested resource was not found.",
    "type": "not_found_error",
    "param": null,
    "code": "resource_not_found"
  }
}

Requires byok:read scope. Naturally idempotent.

The response is redacted metadata only — a masked key_prefix and coarse validation_status, never the provider secret or provider diagnostics.

The response may carry propagation_status: "pending" while a change to this key’s provider takes effect (within about 5 minutes).

All parameters, request/response schemas, and examples are auto-generated from the OpenAPI specification.

Authorizations

Authorization

string

header

required

API key authentication. Keys start with ak_ prefix. Example: Authorization: Bearer ak_live_xxxxxxxxxxxx

Path Parameters

workspace_id

string<uuid>

required

Workspace identifier

byok_key_id

string<uuid>

required

BYOK key identifier

Response

BYOK key metadata. Redacted — the provider secret is never returned.

string<uuid>

required

Unique identifier for the BYOK key

workspace_id

string<uuid>

required

Workspace this key belongs to

provider

string

required

Provider identifier

name

string

required

Human-readable name for the key

key_prefix

string

required

Masked display prefix of the submitted secret

is_default

boolean

required

Whether this key is the provider's default for routing

disabled

boolean

required

Disabled keys are excluded from routing; the secret stays encrypted at rest

validation_status

enum<string>

required

Coarse validation status (no provider diagnostics)

Available options:

valid,

pending,

invalid,

error

created_at

string<date-time>

required

updated_at

string<date-time>

required

account_tier

string | null

Provider account tier used for rate-limit and data-policy routing

account_tier_source

enum<string> | null

How the tier was determined

Available options:

auto_detected,

user_specified,

fallback,

null

last_validated_at

string<date-time> | null

When the key last passed validation (null if never)

propagation_status

enum<string> | null

"pending" while a routing-affecting change for this key's provider is committed but edge propagation has not yet been applied

Available options:

pending,

null

Create BYOK key Update BYOK key