Introspect API key
Reports what the calling key can do right now: the manufacturer it belongs
to, the scopes it can exercise, and the plants it can reach. Call it once
after wiring up a new key to confirm the setup, and whenever a 403 needs
explaining.
Scopes and plants are the live intersection of what the key was granted and what its issuing member may currently do, so both can shrink after issuance without the key itself changing. Any valid key may call this endpoint — it requires no scope.
Authorizations
Per-manufacturer API key in the X-API-Key header, format
emidat-{key_id}-{secret} where key_id is a random public handle.
Issued by an owner in the Emidat
dashboard; carries its own permission scopes, optional plant
restrictions, and optional expiry. A revoked, expired, or unknown key
returns 401. See the Authentication guide for details.
Response
What the calling key can do right now.
Emidat UUID of the manufacturer the key belongs to. This endpoint is
the only way to obtain it — the key_id segment of the key is a
random handle and encodes nothing about the manufacturer.
Emidat UUID of the key itself. Use it to tell keys apart in the Emidat UI and in support requests; it is not a credential.
Emidat UUID of the member who issued the key. The key can never do more than that member currently may.
The permissions the key can exercise, after intersecting its grant
with the issuing member's current role. An endpoint that requires a
scope the key does not hold answers 403. An edit: scope is only
granted alongside its view: counterpart — a key never writes a
field it cannot read.
view:plants, view:processes, edit:processes, view:products, edit:products, view:recipes, edit:recipes, view:materials, edit:materials The plants the key can reach, listed explicitly — there is no
wildcard for "all plants". An empty list means the key reaches none:
plant-scoped reads come back empty and GET …/{id} answers 403.