# API Reference

REST API reference generated from the KeyEnv OpenAPI specification.

Source: https://keyenv.dev/docs/api/

Complete reference for the KeyEnv REST API, generated from the OpenAPI 3.1.0 specification.

## Base URL

```
https://api.keyenv.dev
```

## OpenAPI specification

The machine-readable specification is published alongside these docs:

- [openapi.yaml](/openapi.yaml)
- [openapi.json](/openapi.json)

Import either file into Swagger Editor, Postman, Insomnia, or an AI agent to explore the API programmatically.

## Authentication

Every endpoint except `/health` and `/api/v1` requires a bearer token in the `Authorization` header. Both a Clerk JWT (web dashboard) and a KeyEnv service token (CI/CD, prefix `st_`) are accepted.

```bash
curl -H "Authorization: Bearer $KEYENV_TOKEN" \
  https://api.keyenv.dev/api/v1/projects
```

## Endpoint groups

- [Health](/docs/api/health): Health check endpoints
- [Auth](/docs/api/auth): Authentication and user sync
- [Users](/docs/api/users): User management
- [Teams](/docs/api/teams): Team management and collaboration
- [Invitations](/docs/api/invitations): Team invitation management
- [Projects](/docs/api/projects): Project management
- [Environments](/docs/api/environments): Environment management within projects
- [Secrets](/docs/api/secrets): Secret management (encrypted key-value pairs)
- [Permissions](/docs/api/permissions): Environment-level access control
- [Tokens](/docs/api/tokens): Service token management for CI/CD
- [Rotations](/docs/api/rotations): Automated credential rotation for database secrets
- [Scans](/docs/api/scans): Secret scanning for detecting hardcoded secrets
- [ESO](/docs/api/eso): External Secrets Operator (ESO) webhook endpoints for Kubernetes integration.
- [Audit](/docs/api/audit): Audit log access
- [Billing](/docs/api/billing): Billing and usage information
- [CLI](/docs/api/cli): CLI authentication endpoints for device authorization flow
- [Account](/docs/api/account): GDPR and account management