{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/arkova-ai/json-schema/arkova-ai-api-key-masked-schema.json",
  "title": "ApiKeyMasked",
  "x-generated": "2026-11-01",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/arkova-ai-openapi.json#/components/schemas/ApiKeyMasked",
  "type": "object",
  "properties": {
    "id": {
      "type": "string",
      "format": "uuid"
    },
    "key_prefix": {
      "type": "string"
    },
    "name": {
      "type": "string"
    },
    "scopes": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "x-arkova-canonical-scopes": [
        "read:records",
        "read:orgs",
        "read:search",
        "write:anchors",
        "admin:rules",
        "verify",
        "verify:batch",
        "usage:read",
        "keys:manage",
        "compliance:read",
        "compliance:write",
        "oracle:read",
        "oracle:write",
        "anchor:write",
        "anchor:read",
        "attestations:write",
        "attestations:read",
        "webhooks:manage",
        "agents:manage",
        "keys:read",
        "orgs:manage",
        "agent_actions:write",
        "ai:extract"
      ]
    },
    "is_active": {
      "type": "boolean"
    },
    "last_used_at": {
      "type": [
        "string",
        "null"
      ],
      "format": "date-time"
    },
    "created_at": {
      "type": "string",
      "format": "date-time"
    },
    "expires_at": {
      "type": [
        "string",
        "null"
      ],
      "format": "date-time"
    },
    "status": {
      "type": "string",
      "enum": [
        "active",
        "expiring_soon",
        "expired",
        "revoked"
      ],
      "description": "Server-derived usability. Prefer this over is_active/expires_at: is_active is a stored flag that stays true on an expired key, while authentication rejects it. expiring_soon means live and expiring within 14 days."
    },
    "days_until_expiry": {
      "type": [
        "integer",
        "null"
      ],
      "description": "Whole days until expiry — 0 on the final day, negative once past, null when the key does not expire. Deliberately NOT named expires_in_days: that is the REQUEST field on POST/PATCH and means a duration to set, not a countdown to read."
    },
    "principal_version": {
      "type": [
        "integer",
        "null"
      ],
      "description": "Version 1 binds a human actor immutably; version 0 retains legacy issuer identity."
    },
    "principal_kind": {
      "type": [
        "string",
        "null"
      ],
      "enum": [
        "legacy",
        "human"
      ]
    },
    "actor_user_id": {
      "type": [
        "string",
        "null"
      ],
      "format": "uuid",
      "description": "Immutable acting member for version 1 keys."
    },
    "issuer_user_id": {
      "type": [
        "string",
        "null"
      ],
      "format": "uuid",
      "description": "Administrator who issued the key; audit provenance, not the member acting identity."
    },
    "assigned_user_id": {
      "type": [
        "string",
        "null"
      ],
      "format": "uuid",
      "description": "The organization member this org-owned key is assigned to. Null when unassigned."
    },
    "assigned_user": {
      "type": [
        "object",
        "null"
      ],
      "description": "Display fields of the assignee (organization-internal). Null when unassigned.",
      "properties": {
        "id": {
          "type": "string",
          "format": "uuid"
        },
        "full_name": {
          "type": [
            "string",
            "null"
          ]
        },
        "email": {
          "type": [
            "string",
            "null"
          ]
        }
      }
    }
  }
}