API Reference

Test API Key

Return current metadata for an API key without rotating its secret. The plaintext key is never returned — only its id, status, environment, scopes, project binding, and expiry. Useful as the SDK's first call after a key is configured to verify wiring end-to-end.

POST/org/api-keys/{key_id}/test

Authentication

Accepts a JWT bearer token (Authorization: Bearer eyJ…) or an API key (X-API-Key: ms_live_…). API-key callers should send X-Project-ID unless the key is project-locked. Cross-tenant operators must send X-Tenant-ID.

Path parameters

Field	Type	Required	Description
`key_id`	`integer`	required	API key id.

Response

Returns 200 OK with the following body.

Field	Type	Required	Description
`key_id`	`integer`	optional	Echoed key id.
`valid`	`boolean`	optional	`true` only when status is `active` AND not expired.
`status`	`string`	optional	`active` \| `revoked` \| `expired`.
`environment`	`string`	optional	Environment binding (`production` / `staging` / …).
`rate_limit_tier`	`string`	optional	Tier label, may be `null`.
`scopes`	`string[]`	optional	Granted scopes.
`project_id`	`string`	optional	Bound project id, or `null` for org-wide keys.
`last_used_at`	`string`	optional	RFC 3339 UTC, nullable.
`expires_at`	`string`	optional	RFC 3339 UTC, nullable for non-expiring keys.
`expired`	`boolean`	optional	`true` when `expires_at <= server_time`.
`server_time`	`string`	optional	Server-side reference clock for `expired` evaluation.

200.json

{
  "key_id": 501,
  "valid": true,
  "status": "active",
  "environment": "production",
  "rate_limit_tier": "standard",
  "scopes": [
    "memories:read",
    "memories:write"
  ],
  "project_id": "proj_support_bot",
  "last_used_at": "2026-05-04T12:00:00Z",
  "expires_at": "2026-08-04T00:00:00Z",
  "expired": false,
  "server_time": "2026-05-04T12:31:00Z"
}

Errors

Status	Code	Description
400	`validation_error`	Body or query failed schema validation. The error includes the offending `field` name.
401	`unauthenticated`	Missing or invalid bearer token / API key.
403	`forbidden`	Authenticated principal lacks the required scope, role, or project access.
404	`not_found`	Target resource does not exist or is not visible to the calling tenant.
429	`rate_limited`	Per-IP or per-route limit exceeded. Respect the `Retry-After` header.
500	`internal_error`	Unhandled server error. Quote the `request_id` when contacting support.

Examples

cURL

curl -X POST https://api.memorysync.io/org/api-keys/EXAMPLE_ID/test \
  -H "Authorization: Bearer $MEMORYSYNC_KEY"

javascript

import { MemorySync } from 'memorysync'

const client = new MemorySync({ apiKey: process.env.MEMORYSYNC_KEY })

const result = await client.request({
  method: 'POST',
  path: '/org/api-keys/EXAMPLE_ID/test',
})
console.log(result)

python

from memorysync import Client

client = Client(api_key=os.environ["MEMORYSYNC_KEY"])

result = client.request(
    method="POST",
    path="/org/api-keys/EXAMPLE_ID/test",
)
print(result)

Behavior & notes

Requires owner, admin, or developer role and admin:read scope. The handler never reads or returns the plaintext secret. Cross-project requests (X-Project-ID header) get 404 for keys scoped to a different project.

← Previous

Bulk Revoke Keys

Billing