MemorySync
API Reference · Control-plane API

Test API Key

Inspect the current status and metadata of one organization API key without rotating or revealing its secret.

Endpoint contract

POST/org/api-keys/{key_id}/test
200 OK

Use the exact method and path shown above. Paths are relative to the API base URL.

Authentication, permission, and scope

ControlRequired contract
AuthenticationBearer access token for an active organization member.
Permission or scopeapi_keys.view capability and admin:read scope.
Resource scopeThe key must belong to the caller’s organization and selected project context.

Request fields

FieldTypeContract
key_idinteger path parameterRequired API-key record ID. This is not the raw secret.
Request bodynoneDo not send a JSON body.

Code examples

import os
from memorysync import ControlPlaneClient


client = ControlPlaneClient(
    base_url="https://api.memorysync.io",
    access_token=os.environ["MEMORYSYNC_ACCESS_TOKEN"],
)


result = client.test_api_key(
    41,
    project_id=os.environ["MEMORYSYNC_PROJECT_ID"],
)

Response shape

response.json
{"key_id":41,"valid":true,"status":"active","environment":"production","rate_limit_tier":"pro","scopes":["memories:read"],"project_id":"project_abc123","last_used_at":"2026-07-31T10:00:00Z","expires_at":null,"expired":false,"server_time":"2026-08-01T12:00:00Z"}
  • valid is true only when the key is active and not expired.
  • The response contains metadata, never the secret value.

Status outcomes

HTTP outcomes
2xx
Request completed

Read the operation-specific response and persist only fields needed by the task.

400 / 422
Correct the request

Fix invalid path, query, or body fields before trying again.

401 / 403
Access denied

Refresh authentication or verify the required organization permission and scope.

404
Unavailable in scope

Treat the resource as unavailable without revealing whether it exists elsewhere.

429 / 5xx
Keep the action recoverable

Use returned retry metadata when present and reconcile uncertain mutations before repeating them.

Production handling

Production request path
  1. 01

    Authorize

    APP

    Confirm the signed-in principal may perform this product action.

  2. 02

    Validate

    INPUT

    Validate identifiers and body fields before sending the request.

  3. 03

    Call

    SDK

    Use the named ControlPlaneClient method or equivalent HTTPS request from a trusted application context.

  4. 04

    Inspect

    RESULT

    Use valid, status, and expired to render the current state.

  5. 05

    Reconcile

    SAFE

    A valid metadata result does not replace a real operation-level integration check.

Security notes

Control-plane safety

Required

Keep organization controls inside trusted boundaries.

  • Use the database key ID, not a secret, in the path.
  • Do not log bearer tokens or attempt to reconstruct the API key.
  • Treat a 404 as unavailable in the current scope.

Avoid

Do not weaken the route contract in client code.

  • Do not expose bearer or refresh tokens in URLs, logs, or public clients.
  • Do not accept organization, member, project, or resource IDs without application authorization.
  • Do not treat returned data as trusted HTML, prompt instructions, or proof of application authorization.

Related reference

Bulk Revoke API Keys

Revoke selected organization keys.

Authentication

Compare bearer-authenticated control-plane clients with the memory API-key client.

API Overview

Choose the SDK client and authentication contract for the operation.

Was this page helpful?
← Previous
Bulk Revoke API Keys
Next →
List Active Sessions