app.api_keys
TableRow level security on
Org-scoped API keys for servers (ADR 0003): hashed, capability-scoped and expiring. The secret is shown once at creation; only its SHA-256 hash is stored.
Primary key: id
| Column | Type | Nullable | Description |
|---|---|---|---|
| id | uuid | No | Primary key, UUID v7. |
| org_id | uuid | No | Owning org. A row never moves to another org.References app.organizations.id |
| name | text | No | Key name shown in Settings, for example Accounting Sync. |
| service_account_id | uuid | Yes | Service account the key acts for, once service accounts exist; null for an org key.References app.service_accounts.id |
| scopes | text[] | No | Capability groups (the first segment of capability codes in the registry) the key may use. |
| expires_at | timestamp with time zone | No | When the key stops working. At most one year after it is set. |
| prefix | text | No | Visible start of the secret (xos_live_ and 8 hex digits), so people can tell keys apart. |
| secret_hash | bytea | No | SHA-256 of the full secret. Never readable by signed-in callers. |
| last_used_at | timestamp with time zone | Yes | When the key last authenticated a request, to the minute. |
| revoked_at | timestamp with time zone | Yes | When the key was revoked; a revoked key never works again. |
| revoked_by | uuid | Yes | Person who revoked the key.References app.people.id |
| created_at | timestamp with time zone | No | When the row was inserted. Set by the database. |
| created_by | uuid | Yes | Person who inserted the row, or null for a platform process. Set by the database.References app.people.id |
| updated_at | timestamp with time zone | No | When the row last changed. Set by the database. |
| updated_by | uuid | Yes | Person who last changed the row, or null for a platform process. Set by the database.References app.people.id |
| deleted_at | timestamp with time zone | Yes | Soft delete time. A row with deleted_at set is ignored by every access helper. |