OVOK DOCS
Get startedOvokSignalsSDKsGuidesAPI referenceDeveloper resources
Payload CMS API Keys

List the project's CMS API keys

  • Sandbox: available
  • Staging: available
  • Production: unknown
GET
/v1/cms/api-keys

Lists the API keys of your current project's CMS content. A key unlocks public CMS delivery (/v1/public/cms/...) of this project's tenant only. The keys themselves are never returned.

Auth: bearer token of a project admin. The caller must also be a Practitioner, an admin or hold the System Owner access policy. Scope: the caller's project (from the token).

Behaviour

  • keys is newest first. Each has id, name, prefix (the key's first 12 characters, to tell keys apart), createdAt and isDefault.
  • Every project starts with one key, isDefault: true with id default and createdAt: null: the key public delivery took before keys were per project. It works until you revoke it. Its prefix is only its first 4 characters: the same key serves every project that has not revoked it.

Example

curl -X GET 'https://api.sandbox.ovok.com/v1/cms/api-keys' \  -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3NjcyNjg4MDAsImV4cCI6MTc2NzI3MjQwMH0.Ql3B_ztDvctlyZ2z0vp4sl3ExXRQGkzmxdmTAqxNzZk'

Authorization

bearer
headerAuthorizationBearer <JWT>

Response Body

The keys, newest first. Never a key itself.

application/json
  1. response
keys*array<>
Example Request
curl -X GET 'https://api.sandbox.ovok.com/v1/cms/api-keys'
Example Response
{  "keys": [    {      "id": "string",      "name": "string",      "prefix": "string",      "createdAt": "string",      "isDefault": true    }  ]}

End a share DELETE

Ends a share, cancels a pending invite, or declines a practitioner's invite. A related person (a carer) leaves a share they received. Access stops at once. **Auth:** bearer token of a Patient or a RelatedPerson. **Scope:** the caller's project (from the token). ## Behaviour - Who may call it, by `consentId`: - a patient-to-patient share: the sharer or the recipient; - a pending patient-to-patient invite: the sharer (this cancels it); - a share of the caller's record with a practitioner, or a practitioner's pending invite to the caller: the patient. - a share of the caller's codes with a related person, or its pending invite: the patient; - a share a patient gave the caller as their related person: the related person (see below). - A practitioner gets 403. - Every grant bound to the Consent is removed from the members who hold it, and the Consent is set to `inactive`, in one atomic write. The holders' cached sessions are refreshed. - Calling it again on an ended share only sweeps any grants left behind, so retrying is safe. - If the records keep changing during the write, it retries up to three times, then answers 409. Retry the call. - Returns `204 No Content`. ## A related person leaving a share - The Consent is set to `inactive`, as when the patient ends it, and its grant leaves the caller's own membership, in one atomic write. The caller's cached sessions are refreshed. - The membership keeps its base policy. One that had lost it gets it back, so it never reads as full project access. - `404` when the share is not one the caller received, for example another carer's or a patient-to-patient share. It never says whose it is. - `409` when the share already ended, or a record changed during the write. Read the list again and retry. ## Example ```bash curl -X DELETE 'https://api.sandbox.ovok.com/v1/patient-sharing/shares/c3499c27-2973-0a7f-807e-fb8676a92dcb' \ -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3NjcyNjg4MDAsImV4cCI6MTc2NzI3MjQwMH0.Ql3B_ztDvctlyZ2z0vp4sl3ExXRQGkzmxdmTAqxNzZk' ```

Create a CMS API key POST

Creates an API key for public CMS delivery (`/v1/public/cms/...`) of your current project's tenant. The answer carries the key itself, once: it is stored only as a hash and cannot be shown again. **Auth:** bearer token of a project admin. The caller must also be a Practitioner, an admin or hold the System Owner access policy. **Scope:** the caller's project (from the token). ## Behaviour - `name` is 1 to 64 characters, trimmed. - The key starts with `ovok_cms_`. Send it as `x-api-key`, `Authorization: Bearer` or `?apiKey=`, with the tenant it belongs to (`x-ovok-tenant-code`, `?tenant=`, `x-ovok-medplum-project-id` or `?projectId=`). Naming another project's tenant answers 401. - A project holds at most 20 keys, the default key included: one more returns 409 `CMS_API_KEY_LIMIT`. - A 409 without a code means the project changed while the server wrote. Retry. - The answer is 201. ## Example ```bash curl -X POST 'https://api.sandbox.ovok.com/v1/cms/api-keys' \ -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3NjcyNjg4MDAsImV4cCI6MTc2NzI3MjQwMH0.Ql3B_ztDvctlyZ2z0vp4sl3ExXRQGkzmxdmTAqxNzZk' \ -H 'Content-Type: application/json' \ -d '{ "name": "Marketing site" }' ```