Team API keys are designed for service accounts that manage Open Authorization API (OAA) integrations assigned to a team. Similar to personal API keys, these keys authenticate API requests, and can be revoked or reinstated to control programmatic access to Veza. Each key is associated with a single team and has the oaa_push role, restricted to specific read and write operations for creating and updating OAA data sources.
Team API keys are limited to the following operations:
Administrators can create and manage team API keys using the endpoints documented below. Note that Team API Keys are currently provided as an early access feature, and /preview/ API operations are subject to change as capabilities are added or modified.
Method: GET Endpoint: /api/preview/teamkeys
Returns API key details such as last activity time and status. If the query includes a team_id filter expression, only keys for that team are listed.
Note: When using a personal API key for a , the team_id filter is automatically applied. Only root team administrators can view keys across all teams.
Example Request:
Example Response:
Method: POST Endpoint: /api/preview/teamkeys
Create an API key by providing a key name and team team_id. The response includes the access_key, which cannot be retrieved again.
Example Request:
Example Response:
Method: DELETE Endpoint: /api/preview/teamkeys/{id}
Permanently delete a team API key.
Example Request:
Example Response:
Method: POST Endpoint: /api/preview/teamkeys/{id}:revoke
Suspend usage of a team API key, changing the status to INACTIVE.
Example Request:
Example Response:
Method: POST Endpoint: /api/preview/teamkeys/{id}:reinstate
Reinstates a previously revoked team API key, changing the status to ACTIVE.
Example Request:
Example Response:
Method: PATCH Endpoint: /api/preview/teamkeys/{value.id}
Use this operation to update the display name of a team API key.
Example Request:
Example Response:
curl -X GET "https://<base-url>/api/preview/teamkeys?filter=team_id+eq+%2260437fa0-15ab-4c1f-a211-010543ac8a89%22" \
-H "accept: application/json"{
"values": [
{
"id": "54807783-c5ec-4efd-9d1b-853bada658dd",
"access_key": "",
"name": "AWS Team Key",
"created_at": "2024-06-25T08:30:17.087351612Z",
"last_access_at": "2024-06-25T08:30:17.087351612Z",
"status": "ACTIVE",
"team_id": "60437fa0-15ab-4c1f-a211-010543ac8a89"
}
],
"next_page_token": ""
}curl -X POST "https://<base-url>/api/preview/teamkeys" \
-H "accept: application/json" \
-H "content-type: application/json" \
-d '{"name":"New Team API Key","team_id":"60437fa0-15ab-4c1f-a211-010543ac8a89"}'{
"value": {
"id": "7ddd5e0c-29cd-41c5-b41f-884b2d24b05d",
"access_key": "<access key>",
"name": "New Team API Key",
"created_at": "2024-08-26T21:29:59.409761363Z",
"last_access_at": "2024-08-26T21:29:59.409761363Z",
"status": "ACTIVE",
"team_id": "60437fa0-15ab-4c1f-a211-010543ac8a89"
}
}curl -X DELETE "https://<base-url>/api/preview/teamkeys/7ddd5e0c-29cd-41c5-b41f-884b2d24b05d" \
-H "accept: application/json"{
"value": {
"id": "7ddd5e0c-29cd-41c5-b41f-884b2d24b05d",
"access_key": "",
"name": "Updated API Key",
"created_at": "2024-08-26T21:29:59.409761363Z",
"last_access_at": "2024-08-26T21:29:59.409761363Z",
"status": "INACTIVE",
"team_id": "60437fa0-15ab-4c1f-a211-010543ac8a89"
}
}curl -X POST "https://<base-url>/api/preview/teamkeys/7ddd5e0c-29cd-41c5-b41f-884b2d24b05d:revoke" \
-H "accept: application/json"{}curl -X POST "https://<base-url>/api/preview/teamkeys/7ddd5e0c-29cd-41c5-b41f-884b2d24b05d:reinstate" \
-H "accept: application/json"{}curl -X PATCH "https://<base-url>/api/preview/teamkeys/7ddd5e0c-29cd-41c5-b41f-884b2d24b05d" \
-H "accept: application/json"\
-H "content-type: application/json" \
-d '{"name":"Updated API Key"}'{
"value": {
"id": "7ddd5e0c-29cd-41c5-b41f-884b2d24b05d",
"access_key": "",
"name": "Updated API Key",
"created_at": "2024-08-26T21:29:59.409761363Z",
"last_access_at": "2024-08-26T21:29:59.409761363Z",
"status": "ACTIVE",
"team_id": "60437fa0-15ab-4c1f-a211-010543ac8a89"
}
}Bearer token authentication using a Veza Personal API key.
Header Format: Authorization: Bearer <your-api-key>
Creating an API Key:
[team_id] String to filter API keys belonging to a specific team. If empty, list all team keys in scope
OK
Default error response
Bearer token authentication using a Veza Personal API key.
Header Format: Authorization: Bearer <your-api-key>
Creating an API Key:
Human friendly name
Service account's team ID
OK
Default error response
Bearer token authentication using a Veza Personal API key.
Header Format: Authorization: Bearer <your-api-key>
Creating an API Key:
OK
Default error response
Bearer token authentication using a Veza Personal API key.
Header Format: Authorization: Bearer <your-api-key>
Creating an API Key:
OK
Default error response
Bearer token authentication using a Veza Personal API key.
Header Format: Authorization: Bearer <your-api-key>
Creating an API Key:
OK
Default error response
Bearer token authentication using a Veza Personal API key.
Header Format: Authorization: Bearer <your-api-key>
Creating an API Key:
API Key
The unique identifier of this API key.
Base64 encoded access token. Only available when creating a key
User provided name for this key
ISO-8601 timestamp of when this key was created
ISO-8601 timestamp of when this key was last updated
Status of the key. Key is ACTIVE or INACTIVE. API keys can only be used when they are ACTIVE
Team ID that this key belongs to
Team Name that this key belongs to
OK
Default error response
{
"value": {
"id": "text",
"access_key": "text",
"name": "text",
"created_at": "2025-12-09T03:12:15.801Z",
"last_access_at": "2025-12-09T03:12:15.801Z",
"status": 1,
"team_id": "text",
"team_name": "text"
}
}{
"value": {
"id": "text",
"access_key": "text",
"name": "text",
"created_at": "2025-12-09T03:12:15.801Z",
"last_access_at": "2025-12-09T03:12:15.801Z",
"status": 1,
"team_id": "text",
"team_name": "text"
}
}GET /api/preview/teamkeys HTTP/1.1
Host: your-tenant.cookiecloud.ai
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
POST /api/preview/teamkeys HTTP/1.1
Host: your-tenant.cookiecloud.ai
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 32
{
"name": "text",
"team_id": "text"
}DELETE /api/preview/teamkeys/{id} HTTP/1.1
Host: your-tenant.cookiecloud.ai
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
{
"value": {
"id": "text",
"access_key": "text",
"name": "text",
"created_at": "2025-12-09T03:12:15.801Z",
"last_access_at": "2025-12-09T03:12:15.801Z",
"status": 1,
"team_id": "text",
"team_name": "text"
}
}POST /api/preview/teamkeys/{id}:revoke HTTP/1.1
Host: your-tenant.cookiecloud.ai
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
{}POST /api/preview/teamkeys/{id}:reinstate HTTP/1.1
Host: your-tenant.cookiecloud.ai
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
{}PATCH /api/preview/teamkeys/{value.id} HTTP/1.1
Host: your-tenant.cookiecloud.ai
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 44
{
"id": "text",
"name": "text",
"team_id": "text"
}{
"values": [
{
"id": "text",
"access_key": "text",
"name": "text",
"created_at": "2025-12-09T03:12:15.801Z",
"last_access_at": "2025-12-09T03:12:15.801Z",
"status": 1,
"team_id": "text",
"team_name": "text"
}
],
"next_page_token": "text"
}