apiKey

apiKey is one of the estate's 317 automotive nouns — a job a car needs done. It carries 5 capabilities: 2 live, 3 sandbox, 0 declared · doors apis.vin · aggregator.vin.

Identity

Lifecycle

ApiKey — ApiKeyStatus: 3 states, 3 transitions — active · superseded · revoked. Each transition is a past-tense event on the record.

Events

The vocabulary this noun can append to the record — 5 past-tense, versioned event types, each linked to the capability that emits it:

• ApiKey.created@1 — emitted by create
• ApiKey.minted@1 — emitted by mint · rotate
• ApiKey.revoked@1 — emitted by revoke
• ApiKey.rotated@1 — emitted by rotate
• ApiKey.scoped@1 — emitted by scope

Apply & book

create

apiKey.create · POST /api-keys/create · gate key · sandbox · answers ApiKeyCreate@1

No input — this capability takes no request body.

Door — aggregator.vin serves this noun on its two routes: / (the landing) · /1C4PJXDG6RW358421 (the VIN lens).

Try it — sandbox: every call answers a deterministic, provenance-labeled simulated payload ({ environment, simulated } in the body). Force any documented outcome with the magic triggers. Going live is a connect, never a ballot: submit the credential at integrates.vin (dealer systems) or connects.vin (consumer accounts) — submissions enter the activation queue and rank live rollout.

Emits — ApiKey.created@1.

import { apiKey } from 'apis.vin'

// the gate law is in the type system: Answer<T> = Ok | Empty | Blocked | Offer
const answer = await apiKey.create()

curl -X POST https://apis.vin/api-keys/create \
  -H 'content-type: application/json' \
  -d '{}'

Receipt — the sandbox wire answered the request above with this exact body at build time. Captured by the receipts runner (timestamped, provenance in the payload), never authored; it re-executes only when this descriptor changes.

{
  "type": "OK",
  "answers": "ApiKeyCreate@1",
  "value": {
    "apiKey": "apikey_b7579ff8",
    "prefix": "vin_sk_3c639b",
    "subject": "agent_vinsandbox0001",
    "scopes": [
      "read",
      "act"
    ],
    "status": "active",
    "createdAt": "2026-08-10T00:00:00.000Z",
    "secretOnce": "vin_sk_3c639bc5••••••••••••••••••••••••"
  },
  "evidence": {
    "apiKey": "apikey_b7579ff8",
    "prefix": "vin_sk_3c639b",
    "subject": "agent_vinsandbox0001",
    "scopes": [
      "read",
      "act"
    ],
    "status": "active",
    "createdAt": "2026-08-10T00:00:00.000Z",
    "secretOnce": "vin_sk_3c639bc5••••••••••••••••••••••••"
  },
  "provenance": {
    "simulated": true,
    "environment": "sandbox",
    "source": "governance-sandbox"
  },
  "events": [],
  "meter": {
    "charged": "0.00",
    "posted": false
  }
}

Fulfill & operate

rotate

apiKey.rotate · POST /api-keys/rotate · gate key · live · answers ApiKey@1

Promoted — earned its own page: /catalog/apiKey.rotate (computed on every regen: live on the wire + carries its own stateSet).

No input — this capability takes no request body.

Door — apis.vin serves this noun on its two routes: / (the landing) · /1C4PJXDG6RW358421 (the VIN lens).

Try it — live: answers on the wire today. A sandbox key still selects the deterministic simulated mode — drive the full outcome range with the magic triggers.

Emits — ApiKey.minted@1 · ApiKey.rotated@1.

import { apiKey } from 'apis.vin'

// the gate law is in the type system: Answer<T> = Ok | Empty | Blocked | Offer
const answer = await apiKey.rotate()

curl -X POST https://apis.vin/api-keys/rotate \
  -H 'content-type: application/json' \
  -d '{}'

Authorize & resolve

revoke

apiKey.revoke · POST /api-keys/revoke · gate key · sandbox · answers ApiKey@1

No input — this capability takes no request body.

Door — apis.vin serves this noun on its two routes: / (the landing) · /1C4PJXDG6RW358421 (the VIN lens).

Try it — sandbox: every call answers a deterministic, provenance-labeled simulated payload ({ environment, simulated } in the body). Force any documented outcome with the magic triggers. Going live is a connect, never a ballot: submit the credential at integrates.vin (dealer systems) or connects.vin (consumer accounts) — submissions enter the activation queue and rank live rollout.

Emits — ApiKey.revoked@1.

import { apiKey } from 'apis.vin'

// the gate law is in the type system: Answer<T> = Ok | Empty | Blocked | Offer
const answer = await apiKey.revoke()

curl -X POST https://apis.vin/api-keys/revoke \
  -H 'content-type: application/json' \
  -d '{}'

Receipt — the sandbox wire answered the request above with this exact body at build time. Captured by the receipts runner (timestamped, provenance in the payload), never authored; it re-executes only when this descriptor changes.

{
  "type": "OK",
  "answers": "ApiKey@1",
  "value": {
    "id": "id-e2e3698e",
    "prefix": "prefix-be638bd7",
    "trustTier": "trustTier-de61f367",
    "scopes": "array-4be76e5e",
    "mandateBinding": "mandateBinding-6ea1c106",
    "owner": "principal-37dc83f6",
    "createdAt": "2027-04-20T00:00:00.000Z",
    "lastRotatedAt": "2027-04-20T00:00:00.000Z",
    "expiresAt": "2027-04-20T00:00:00.000Z",
    "status": "state-058046f5"
  },
  "evidence": {
    "id": "id-e2e3698e",
    "prefix": "prefix-be638bd7",
    "trustTier": "trustTier-de61f367",
    "scopes": "array-4be76e5e",
    "mandateBinding": "mandateBinding-6ea1c106",
    "owner": "principal-37dc83f6",
    "createdAt": "2027-04-20T00:00:00.000Z",
    "lastRotatedAt": "2027-04-20T00:00:00.000Z",
    "expiresAt": "2027-04-20T00:00:00.000Z",
    "status": "state-058046f5"
  },
  "provenance": {
    "simulated": true,
    "environment": "sandbox",
    "source": "api-key-sandbox"
  },
  "events": [],
  "meter": {
    "charged": "0.00",
    "posted": false
  }
}

More actions

mint

apiKey.mint · POST /api-keys/mint · gate key · live · answers ApiKey@1

Promoted — earned its own page: /catalog/apiKey.mint (computed on every regen: live on the wire + carries its own stateSet).

No input — this capability takes no request body.

Door — apis.vin serves this noun on its two routes: / (the landing) · /1C4PJXDG6RW358421 (the VIN lens).

Try it — live: answers on the wire today. A sandbox key still selects the deterministic simulated mode — drive the full outcome range with the magic triggers.

Emits — ApiKey.minted@1.

import { apiKey } from 'apis.vin'

// the gate law is in the type system: Answer<T> = Ok | Empty | Blocked | Offer
const answer = await apiKey.mint()

curl -X POST https://apis.vin/api-keys/mint \
  -H 'content-type: application/json' \
  -d '{}'

scope

apiKey.scope · POST /api-keys/scope · gate key · sandbox · answers ApiKeyScope@1

No input — this capability takes no request body.

Door — apis.vin serves this noun on its two routes: / (the landing) · /1C4PJXDG6RW358421 (the VIN lens).

Try it — sandbox: every call answers a deterministic, provenance-labeled simulated payload ({ environment, simulated } in the body). Force any documented outcome with the magic triggers. Going live is a connect, never a ballot: submit the credential at integrates.vin (dealer systems) or connects.vin (consumer accounts) — submissions enter the activation queue and rank live rollout.

Emits — ApiKey.scoped@1.

import { apiKey } from 'apis.vin'

// the gate law is in the type system: Answer<T> = Ok | Empty | Blocked | Offer
const answer = await apiKey.scope()

curl -X POST https://apis.vin/api-keys/scope \
  -H 'content-type: application/json' \
  -d '{}'

Receipt — the sandbox wire answered the request above with this exact body at build time. Captured by the receipts runner (timestamped, provenance in the payload), never authored; it re-executes only when this descriptor changes.

{
  "type": "OK",
  "answers": "ApiKeyScope@1",
  "value": {
    "apiKey": "vk_sandbox",
    "scopes": [
      "read",
      "act"
    ],
    "mandateBinding": "mnd_f7a62e7b",
    "status": "scoped",
    "scopedAt": "2026-08-10T00:00:00.000Z"
  },
  "evidence": {
    "apiKey": "vk_sandbox",
    "scopes": [
      "read",
      "act"
    ],
    "mandateBinding": "mnd_f7a62e7b",
    "status": "scoped",
    "scopedAt": "2026-08-10T00:00:00.000Z"
  },
  "provenance": {
    "simulated": true,
    "environment": "sandbox",
    "source": "governance-sandbox"
  },
  "events": [],
  "meter": {
    "charged": "0.00",
    "posted": false
  }
}

Data model

The record shape behind this noun — one entity, each property an evidence field. See the whole estate model on the data model page.

ApiKey

Schema

Modeled

The noun drawn out — its record shape, its lifecycle, and how it is exercised end to end. 4 diagrams, rendered from the estate model.

ApiKey · Class model

ApiKey · State machine

ApiKey · Class model

ApiKey · State machine

Generated from the catalog. Every capability, answer, gate, and entity on this page is a rendered descriptor — it cannot drift from the wire.