Credentials API
Credential management endpoints
Credentials API
Manage API credentials for authentication.
GET /v1/credentials
List all credentials.
Authentication
Required. Scope: credentials.read
Response
[
{
"client_id": "cl_01HXYZ...",
"scopes": ["urn:tillered:arctic:admin"],
"license_id": "lic_...",
"created_at": "2024-01-15T10:30:00Z",
"last_used_at": "2024-01-16T14:22:00Z"
}
]Note: client_secret is never returned in list responses.
POST /v1/credentials
Create new credentials.
Authentication
Required. Scope: credentials.write
Request Body
{
"scopes": [
"urn:tillered:arctic:peers.read",
"urn:tillered:arctic:services.read"
]
}| Field | Type | Required | Description |
|---|---|---|---|
scopes | array | No | Scopes. Empty = admin access. |
Response
{
"client_id": "cl_01HXYZ...",
"client_secret": "sec_abc123...",
"scopes": ["urn:tillered:arctic:peers.read"],
"created_at": "2024-01-15T10:30:00Z"
}Important: The client_secret is only returned once at creation time.
Available Scopes
| Scope | Description |
|---|---|
urn:tillered:arctic:admin | Full access |
urn:tillered:arctic:peers.read | Read peers |
urn:tillered:arctic:peers.write | Modify peers |
urn:tillered:arctic:services.read | Read services |
urn:tillered:arctic:services.write | Modify services |
urn:tillered:arctic:credentials.read | Read credentials |
urn:tillered:arctic:credentials.write | Modify credentials |
Errors
| Status | Code | Description |
|---|---|---|
| 400 | INVALID_REQUEST | Invalid scope format |
DELETE /v1/credentials/{client_id}
Revoke credentials.
Authentication
Required. Scope: credentials.write
Path Parameters
| Parameter | Description |
|---|---|
client_id | Client ID to revoke |
Response
{
"deleted": true
}Errors
| Status | Code | Description |
|---|---|---|
| 404 | NOT_FOUND | Credential not found |
| 422 | CANNOT_REVOKE_CURRENT | Would lock out user |
POST /v1/cluster/credentials/rotate
Rotate the shared cluster credential.
Authentication
Required. Scope: credentials.write
Response
{
"client_id": "cl_01HXYZ...",
"client_secret": "sec_NEW...",
"version": 2,
"rotated_by": "01HXYZ...",
"rotated_at": "2024-01-15T10:30:00Z"
}Notes
- Generates new client secret
- Old secret valid for 24-hour grace period
- New secret propagates via gossip