docs(api-keys): document the API contract - #414
Merged
mikewheeleer merged 5 commits intoJul 29, 2026
Conversation
The GET /api/v1/api-keys handler inlined the same limit/offset parsing and slicing preamble duplicated in the webhooks list handler. Extracted it into applyOffsetPage() in src/listPagination.ts as a single reusable entry point; behavior is unchanged (same defaults, same response shape).
Adds a generic paginateByCursor() helper (src/cursorPagination.ts) and an applyListPage() wrapper that layers opt-in ?cursor= paging on top of the existing offset/limit contract: passing cursor takes priority over offset, and both modes now report a stable nextCursor so existing offset-based clients can migrate without a contract change. Malformed or expired cursors return 400 invalid_request. Item shape and existing offset behavior are unchanged.
…k labels - GET /api/v1/api-keys now rejects any query parameter outside limit/offset/cursor with a structured 400 invalid_request. - DELETE /api/v1/api-keys/:prefix rejects a malformed prefix (must be 1-64 alphanumeric/underscore chars) with 400 before searching the store, instead of always falling through to a 404. - POST /api/v1/api-keys rejects a whitespace-only label via a new rejectBlank option on stringField, scoped to the label field only.
Adds src/api-keys-endpoint.test.ts covering create/list/revoke, cursor pagination across pages, blank-label rejection, unexpected-body-field rejection, malformed delete-prefix rejection, malformed cursor rejection, unknown-query-param rejection, and an idempotent-repeat check on the list endpoint.
Adds docs/api-keys.md covering GET (list, with the cursor/offset pagination contract), POST (create), and DELETE (revoke), plus an error-codes table.
Contributor
|
well done @thlpkee20-wq, this reads well. merging in 🌟 |
1 similar comment
Contributor
|
well done @thlpkee20-wq, this reads well. merging in 🌟 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #385
Adds
docs/api-keys.mdcoveringGET(list, including the cursor/offsetpagination contract),
POST(create), andDELETE(revoke), plus anerror-codes table.
Test plan
npm run buildnpm run lintNote
Stacked on #410/#411/#412/#413 (same fork-only caveat noted there); this
PR's own change is the single new
docs/api-keys.mdfile, written tomatch the behavior added in those PRs.