Developer access

List service accounts

Access: Owner or admin · Success: 200

25 identities per cursor page, including disabled identities. Credentials cannot use these administrator endpoints.

Query parameters

No request body is required.

Response

curl --request GET \
  --url 'https://app.drykraft.com/api/developer/accounts' \
  --cookie 'drykraft_session=<YOUR_SESSION_TOKEN>'

Create service account

Access: Owner or admin · Success: 201

Current password approval required, limited to 30 approval attempts per account per 15 minutes. Up to 100 active identities. Reuse the same UUID/settings to recover creation without another identity; a completed retry returns 200.

JSON request

Response

Use ServiceAccount.

curl --request POST \
  --url 'https://app.drykraft.com/api/developer/accounts' \
  --cookie 'drykraft_session=<YOUR_SESSION_TOKEN>' \
  --header 'Content-Type: application/json' \
  --data '{
  "id": "00000000-0000-4000-8000-000000000001",
  "name": "<Service account name>",
  "permissions": {
    "people": [
      "read"
    ]
  },
  "password": "<CURRENT_PASSWORD>"
}'

Update service account

Access: Owner or admin · Success: 200

Current version required. Expanding permissions or enabling a disabled identity requires current password. Reductions permanently narrow existing keys; empty keys revoke. Later expansion does not restore their former permissions. Disable waits for in-flight transactions; future requests fail. Keys/identities remain for audit history.

JSON request

Response

Use ServiceAccount.

curl --request PUT \
  --url 'https://app.drykraft.com/api/developer/accounts/00000000-0000-4000-8000-000000000001' \
  --cookie 'drykraft_session=<YOUR_SESSION_TOKEN>' \
  --header 'Content-Type: application/json' \
  --data '{
  "name": "<Name>",
  "permissions": {
    "people": [
      "read"
    ]
  },
  "disabled": false,
  "version": 1
}'

List account keys

Access: Owner or admin · Success: 200

25 keys per cursor page. Includes revoked/expired keys; secrets and token hashes are never returned.

Query parameters

No request body is required.

Response

curl --request GET \
  --url 'https://app.drykraft.com/api/developer/accounts/00000000-0000-4000-8000-000000000001/keys' \
  --cookie 'drykraft_session=<YOUR_SESSION_TOKEN>'

Issue a scoped key

Access: Owner or admin · Success: 201

Current password/account version required. Permissions cannot exceed the saved account ceiling. Up to 10 active keys per identity, expiry 1-365 days. Secret appears only in the first 201 response; repeated UUID/settings return 200 and secret=null. This is not a retrievable credential.

JSON request

Response

Use KeyReceipt.

curl --request POST \
  --url 'https://app.drykraft.com/api/developer/accounts/00000000-0000-4000-8000-000000000001/keys' \
  --cookie 'drykraft_session=<YOUR_SESSION_TOKEN>' \
  --header 'Content-Type: application/json' \
  --data '{
  "id": "00000000-0000-4000-8000-000000000001",
  "name": "<Name>",
  "permissions": {
    "people": [
      "read"
    ]
  },
  "days": 1,
  "account_version": 1,
  "password": "<CURRENT_PASSWORD>"
}'

Rotate a key

Access: Owner or admin · Success: 201

Atomically issue a successor with the old key’s current capped permissions and revoke the old key. In-flight work can finish; old-key future requests fail. Requires current password, key/account versions and a new UUID. Same completed rotation returns 200/secret=null; another rotation of a revoked key conflicts.

JSON request

Response

Use KeyReceipt.

curl --request POST \
  --url 'https://app.drykraft.com/api/developer/accounts/00000000-0000-4000-8000-000000000001/keys/00000000-0000-4000-8000-000000000001/rotate' \
  --cookie 'drykraft_session=<YOUR_SESSION_TOKEN>' \
  --header 'Content-Type: application/json' \
  --data '{
  "id": "00000000-0000-4000-8000-000000000001",
  "version": 1,
  "account_version": 1,
  "days": 1,
  "password": "<CURRENT_PASSWORD>"
}'

Revoke a key

Access: Owner or admin · Success: 200

Current key version required. Revoked keys are retained in history; repeated revocation is safe. Revocation waits for an in-flight business transaction before completing.

JSON request

Response

Use APIKey.

curl --request POST \
  --url 'https://app.drykraft.com/api/developer/accounts/00000000-0000-4000-8000-000000000001/keys/00000000-0000-4000-8000-000000000001/revoke' \
  --cookie 'drykraft_session=<YOUR_SESSION_TOKEN>' \
  --header 'Content-Type: application/json' \
  --data '{
  "version": 1
}'

Read API request history

Access: Owner or admin · Success: 200

25 normalized operation/status rows per cursor page. No authorization values, bodies, raw URLs or query strings are recorded. History completes asynchronously after the response; process loss can omit a terminal history row. Valid authenticated attempts are metered before dispatch.

Query parameters

No request body is required.

Response

curl --request GET \
  --url 'https://app.drykraft.com/api/developer/requests' \
  --cookie 'drykraft_session=<YOUR_SESSION_TOKEN>'