OVOK DOCS
Get startedOvokSignalsSDKsGuidesAPI referenceDeveloper resources
Payload CMS API Keys

Create a CMS API key

  • Sandbox: available
  • Staging: available
  • Production: unknown
POST
/v1/cms/api-keys

Creates an API key for public CMS delivery (/v1/public/cms/...) of your current project's tenant. The answer carries the key itself, once: it is stored only as a hash and cannot be shown again.

Auth: bearer token of a project admin. The caller must also be a Practitioner, an admin or hold the System Owner access policy. Scope: the caller's project (from the token).

Behaviour

  • name is 1 to 64 characters, trimmed.
  • The key starts with ovok_cms_. Send it as x-api-key, Authorization: Bearer or ?apiKey=, with the tenant it belongs to (x-ovok-tenant-code, ?tenant=, x-ovok-medplum-project-id or ?projectId=). Naming another project's tenant answers 401.
  • A project holds at most 20 keys, the default key included: one more returns 409 CMS_API_KEY_LIMIT.
  • A 409 without a code means the project changed while the server wrote. Retry.
  • The answer is 201.

Example

curl -X POST 'https://api.sandbox.ovok.com/v1/cms/api-keys' \  -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3NjcyNjg4MDAsImV4cCI6MTc2NzI3MjQwMH0.Ql3B_ztDvctlyZ2z0vp4sl3ExXRQGkzmxdmTAqxNzZk' \  -H 'Content-Type: application/json' \  -d '{ "name": "Marketing site" }'

Authorization

bearer
headerAuthorizationBearer <JWT>

Request Body

application/json
  1. body
name*string
Length1 <= length <= 64

Response Body

The new key, with the key itself. It is shown this once.

application/json
  1. response
id*string

The key id; default for the deployment key every project starts with.

name*string
prefix*string

The first 12 characters of the key (4 for the default key), to tell keys apart. Never the key.

createdAt*string

ISO time the key was created; null for the default key.

isDefault*boolean

Whether this is the deployment key every project starts with.

key*string

The key itself. Shown in this answer only, never again.

Example Request
curl -X POST 'https://api.sandbox.ovok.com/v1/cms/api-keys' \  -H 'Content-Type: application/json' \  -d '{  "name": "string"}'
Example Response
{  "id": "string",  "name": "string",  "prefix": "string",  "createdAt": "string",  "isDefault": true,  "key": "string"}

List the project's CMS API keys GET

Lists the API keys of your current project's CMS content. A key unlocks public CMS delivery (`/v1/public/cms/...`) of this project's tenant only. The keys themselves are never returned. **Auth:** bearer token of a project admin. The caller must also be a Practitioner, an admin or hold the System Owner access policy. **Scope:** the caller's project (from the token). ## Behaviour - `keys` is newest first. Each has `id`, `name`, `prefix` (the key's first 12 characters, to tell keys apart), `createdAt` and `isDefault`. - Every project starts with one key, `isDefault: true` with `id` `default` and `createdAt: null`: the key public delivery took before keys were per project. It works until you revoke it. Its `prefix` is only its first 4 characters: the same key serves every project that has not revoked it. ## Example ```bash curl -X GET 'https://api.sandbox.ovok.com/v1/cms/api-keys' \ -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3NjcyNjg4MDAsImV4cCI6MTc2NzI3MjQwMH0.Ql3B_ztDvctlyZ2z0vp4sl3ExXRQGkzmxdmTAqxNzZk' ```

Revoke a CMS API key DELETE

Revokes one of your current project's CMS API keys. Public delivery stops taking it at once. **Auth:** bearer token of a project admin. The caller must also be a Practitioner, an admin or hold the System Owner access policy. **Scope:** the caller's project (from the token). ## Behaviour - `id` is a key's `id` from `GET /v1/cms/api-keys`; `default` revokes the default key. - A key the project does not hold returns 404 `CMS_API_KEY_NOT_FOUND`. - A 409 means the project changed while the server wrote. Retry. - Public responses a CDN already cached may still be served for up to a minute. - The answer is 204. ## Example ```bash curl -X DELETE 'https://api.sandbox.ovok.com/v1/cms/api-keys/default' \ -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3NjcyNjg4MDAsImV4cCI6MTc2NzI3MjQwMH0.Ql3B_ztDvctlyZ2z0vp4sl3ExXRQGkzmxdmTAqxNzZk' ```