API keys
Tenant API keys. The full key is shown once.
Tenant API keys. The full key is shown once.
Base URL https://api.whabuzz.com. Every request needs Authorization: Bearer <key> unless the operation says otherwise; see Authentication. Errors follow the two-source contract.
Operations on this page:
GET /v1/api-keys: List API keys (prefix only)POST /v1/api-keys: Create an API keyDELETE /v1/api-keys/{key_id}: Revoke a key nowPOST /v1/api-keys/{key_id}/rotate: Rotate a key
#List API keys (prefix only)
GET/v1/api-keys
Auth: API key (tenant key, or app key with X-WhaBuzz-Tenant). Operation id: listApiKeys.
cURL:
curl -X GET "https://api.whabuzz.com/v1/api-keys" \
-H "Authorization: Bearer $WHABUZZ_KEY"Responses
200 Keys
{
"data": [
{
"id": "0b9f8e7d-6c5b-4a39-8271-605f4e3d2c1b",
"name": "Production",
"environment": "live",
"prefix": "wb_live_7Hq2",
"created_at": "2026-10-16T09:10:00Z",
"last_used_at": "2026-10-16T09:40:00Z",
"expires_at": null,
"revoked_at": null
}
]
}#Create an API key
POST/v1/api-keys
The full key is in this response only. Store it now.
Auth: API key (tenant key, or app key with X-WhaBuzz-Tenant). Operation id: createApiKey.
Request body (application/json, required)
| Field | Type | Required | Description |
|---|---|---|---|
name | string | yes | |
environment | live or test | no | Default "live". |
Request example:
{
"name": "Production",
"environment": "live"
}cURL:
curl -X POST "https://api.whabuzz.com/v1/api-keys" \
-H "Authorization: Bearer $WHABUZZ_KEY" \
-H "Content-Type: application/json" \
-d '{
"name": "Production",
"environment": "live"
}'Responses
201 Created
{
"id": "0b9f8e7d-6c5b-4a39-8271-605f4e3d2c1b",
"name": "Production",
"environment": "live",
"prefix": "wb_live_7Hq2",
"key": "wb_live_7Hq2Xc9LmN4pR8sT1vW6yZ0aB3dE5fG7hJ2kM4nP6",
"created_at": "2026-10-16T09:10:00Z"
}Common errors. Shape and meanings are on the Errors page.
| HTTP | WhaBuzz code | Meaning |
|---|---|---|
| 403 | forbidden | Not allowed for this caller |
#Revoke a key now
DELETE/v1/api-keys/{key_id}
Takes effect within 30 seconds everywhere.
Auth: API key (tenant key, or app key with X-WhaBuzz-Tenant). Operation id: revokeApiKey.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
key_id | path | string (uuid) | yes |
cURL:
curl -X DELETE "https://api.whabuzz.com/v1/api-keys/$KEY_ID" \
-H "Authorization: Bearer $WHABUZZ_KEY"Responses
200 Revoked
{
"id": "0b9f8e7d-6c5b-4a39-8271-605f4e3d2c1b",
"revoked_at": "2026-10-16T11:00:00Z"
}Common errors. Shape and meanings are on the Errors page.
| HTTP | WhaBuzz code | Meaning |
|---|---|---|
| 404 | not_found | Not found |
#Rotate a key
POST/v1/api-keys/{key_id}/rotate
Returns a new key. The old key keeps working for 24 hours, then expires.
Auth: API key (tenant key, or app key with X-WhaBuzz-Tenant). Operation id: rotateApiKey.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
key_id | path | string (uuid) | yes |
cURL:
curl -X POST "https://api.whabuzz.com/v1/api-keys/$KEY_ID/rotate" \
-H "Authorization: Bearer $WHABUZZ_KEY"Responses
201 New key
{
"id": "5e4d3c2b-1a09-4f8e-9d7c-6b5a49382716",
"name": "Production",
"environment": "live",
"prefix": "wb_live_Qm3x",
"key": "wb_live_Qm3xV8bN1cK5zL7aS2dF4gH6jP9rT0wY3uE5iO7",
"replaces": "0b9f8e7d-6c5b-4a39-8271-605f4e3d2c1b",
"old_key_expires_at": "2026-10-17T11:00:00Z"
}This page as Markdown: /api/api-keys.md. All docs in one file: /llms-full.txt.