hanzoai 8.5.640 → 8.5.648

package/dist/api/account-api.d.ts

@@ -13,28 +13,28 @@ import type { Configuration } from '../configuration';
 import type { AxiosPromise, AxiosInstance, RawAxiosRequestConfig } from 'axios';
 import globalAxios from 'axios';
 import { type RequestArgs, BaseAPI } from '../base';
+import type { AccountApiKey } from '../models';
 import type { AccountApiKeyList } from '../models';
 import type { AccountAppearance } from '../models';
 import type { AccountCsrfResp } from '../models';
 import type { AccountEmbedStatusResp } from '../models';
-import type { AccountKeyTypeIn } from '../models';
-import type { AccountMintedKey } from '../models';
+import type { AccountKeyEdit } from '../models';
+import type { AccountKeyIn } from '../models';
 import type { AccountOnboardReq } from '../models';
 import type { AccountOnboardResp } from '../models';
-import type { AccountRevokedKey } from '../models';
 /**
  * AccountApi - axios parameter creator
  * @export
  */
 export declare const AccountApiAxiosParamCreator: (configuration?: Configuration) => {
     /**
-     * Revokes the caller\'s own API key of the requested class. The class is the same field mint takes — `?type=publishable`, defaulting to secret — so revoking the key that ships in a browser bundle does not sign its holder out of their own API: the other key keeps working.  Revoking is how a key is replaced when it does not need replacing; minting the same class again rotates it in one step. IAM drops the credential immediately, but cloud caches a home key\'s principal for up to 60s, so a request inside that window may still be served. A member\'s key is never cached.  For callers written against the older shape, the class is also accepted in a JSON request body, read only when `?type=` is absent.
-     * @summary Revokes the caller\'s own API key of the requested class.
-     * @param {string} [type] Type is the key class to act on: \"secret\" (sk-, session-equivalent, belongs on a server) or \"publishable\" (pk-, org-identifying, safe in a browser bundle). Omitted means secret, which is what every existing caller means.
+     * Revokes exactly one API key, by id. Every other key keeps working. The key stays listed as revoked, with who revoked it and when, and can never be used again. IAM refuses it at once; cloud caches a resolved key for up to 60 seconds, so a request inside that window may still be served.  A member revokes their own keys; an org admin revokes any of the org\'s, and revoking someone else\'s is recorded on the audit trail.
+     * @summary Revokes exactly one API key, by id.
+     * @param {string} id ID is the key to act on, from the path.
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
      */
-    deleteAccountKeys: (type?: string, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
+    deleteAccountKeysById: (id: string, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
     /**
      * Returns the signed-in caller\'s own appearance preference — text size, density and accent — read from their IAM account so it is the same on every device and every Hanzo surface. An unset preference is an empty object.  A transient IAM read failure reports the empty preference rather than a 5xx, so a surface applies its published default and never error-toasts on load — the same fail-soft the key read uses.
      * @summary Returns the signed-in caller\'s own appearance preference — text size, density and accent — read from their IAM account so it is the same on every device and every Hanzo surface.
@@ -68,12 +68,21 @@ export declare const AccountApiAxiosParamCreator: (configuration?: Configuration
      */
     getAccountEmbed: (app?: string, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
     /**
-     * Returns the caller\'s own API keys — every type they hold, read AUTHORITATIVELY from IAM rather than from the session claim, which lags a key minted moments ago. No secret material comes back: a secret key is represented by its prefix, and only a publishable key (public by construction) carries its full value.  A transient IAM read failure reports an empty set rather than a 5xx, so the page shows the honest empty state and never a fabricated key.
-     * @summary Returns the caller\'s own API keys — every type they hold, read AUTHORITATIVELY from IAM rather than from the session claim, which lags a key minted moments ago.
+     * Returns the API keys the caller may see, newest first: their own, or every key the org holds when the caller administers it. Each is its own credential with its own name, prefix, status, expiry and limit. Revoked keys stay listed. No secret material comes back; a publishable key, which is public by construction, carries its full value.
+     * @summary Returns the API keys the caller may see, newest first: their own, or every key the org holds when the caller administers it.
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
      */
     getAccountKeys: (options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
+    /**
+     * Changes one key\'s name, permissions, budget, rate or expiry. The secret is not reissued: the key in your deployment keeps working, under its new policy. Only the person the key belongs to may edit it, and a revoked key cannot be edited.
+     * @summary Changes one key\'s name, permissions, budget, rate or expiry.
+     * @param {string} id ID is the key to edit, from the path.
+     * @param {AccountKeyEdit} accountKeyEdit
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    patchAccountKeysById: (id: string, accountKeyEdit: AccountKeyEdit, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
     /**
      * Stores the caller\'s appearance preference on their IAM account, preserving every other field of the row. The accent is validated as a real colour token before it is stored; an unset or invalid axis is dropped rather than stored.
      * @summary Stores the caller\'s appearance preference on their IAM account, preserving every other field of the row.
@@ -90,13 +99,13 @@ export declare const AccountApiAxiosParamCreator: (configuration?: Configuration
      */
     postAccountAvatar: (options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
     /**
-     * Creates — or rotates — the caller\'s API key of the requested type and returns it ONCE. A real IAM failure surfaces as 502, never a fabricated key.  Rotating is what creating means here: a user holds one key per type, so the endpoint is idempotent by (caller, type) and the superseded credential stops working. Two live secrets for one user would make \"revoke my key\" a lie.
-     * @summary Creates — or rotates — the caller\'s API key of the requested type and returns it ONCE.
-     * @param {AccountKeyTypeIn} accountKeyTypeIn
+     * Creates a NEW API key and returns its secret ONCE. It never revokes or changes any other key: every key the caller already holds keeps working. The key is filed in the org the caller acts in and names them as its creator.  An org holds at most 1,000 live keys; past that the create is refused until one is revoked.
+     * @summary Creates a NEW API key and returns its secret ONCE.
+     * @param {AccountKeyIn} accountKeyIn
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
      */
-    postAccountKeys: (accountKeyTypeIn: AccountKeyTypeIn, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
+    postAccountKeys: (accountKeyIn: AccountKeyIn, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
     /**
      * Creates the caller\'s organization. Two flows, keyed on whether the caller already has a home org (mirrors app/onboard/route.ts):    - FIRST-RUN (no home org): create + MOVE the user in as admin, so their next     JWT carries the new owner and the cloud scopes everything to it. This is the     path a fresh OAuth sign-up takes, from the sign-up application\'s org.   - ADDITIONAL (owner set): create the org but do NOT move the user — a move     changes their IAM owner (stripping a SuperAdmin\'s status + orphaning their     current org). They reach the new org via the OrgSwitcher, which re-scopes     X-Org-Id without touching IAM membership. A personal-org request from someone     who already has an org is meaningless → 409.
      * @summary Creates the caller\'s organization.
@@ -112,13 +121,13 @@ export declare const AccountApiAxiosParamCreator: (configuration?: Configuration
  */
 export declare const AccountApiFp: (configuration?: Configuration) => {
     /**
-     * Revokes the caller\'s own API key of the requested class. The class is the same field mint takes — `?type=publishable`, defaulting to secret — so revoking the key that ships in a browser bundle does not sign its holder out of their own API: the other key keeps working.  Revoking is how a key is replaced when it does not need replacing; minting the same class again rotates it in one step. IAM drops the credential immediately, but cloud caches a home key\'s principal for up to 60s, so a request inside that window may still be served. A member\'s key is never cached.  For callers written against the older shape, the class is also accepted in a JSON request body, read only when `?type=` is absent.
-     * @summary Revokes the caller\'s own API key of the requested class.
-     * @param {string} [type] Type is the key class to act on: \&quot;secret\&quot; (sk-, session-equivalent, belongs on a server) or \&quot;publishable\&quot; (pk-, org-identifying, safe in a browser bundle). Omitted means secret, which is what every existing caller means.
+     * Revokes exactly one API key, by id. Every other key keeps working. The key stays listed as revoked, with who revoked it and when, and can never be used again. IAM refuses it at once; cloud caches a resolved key for up to 60 seconds, so a request inside that window may still be served.  A member revokes their own keys; an org admin revokes any of the org\'s, and revoking someone else\'s is recorded on the audit trail.
+     * @summary Revokes exactly one API key, by id.
+     * @param {string} id ID is the key to act on, from the path.
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
      */
-    deleteAccountKeys(type?: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<AccountRevokedKey>>;
+    deleteAccountKeysById(id: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<AccountApiKey>>;
     /**
      * Returns the signed-in caller\'s own appearance preference — text size, density and accent — read from their IAM account so it is the same on every device and every Hanzo surface. An unset preference is an empty object.  A transient IAM read failure reports the empty preference rather than a 5xx, so a surface applies its published default and never error-toasts on load — the same fail-soft the key read uses.
      * @summary Returns the signed-in caller\'s own appearance preference — text size, density and accent — read from their IAM account so it is the same on every device and every Hanzo surface.
@@ -152,12 +161,21 @@ export declare const AccountApiFp: (configuration?: Configuration) => {
      */
     getAccountEmbed(app?: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<AccountEmbedStatusResp>>;
     /**
-     * Returns the caller\'s own API keys — every type they hold, read AUTHORITATIVELY from IAM rather than from the session claim, which lags a key minted moments ago. No secret material comes back: a secret key is represented by its prefix, and only a publishable key (public by construction) carries its full value.  A transient IAM read failure reports an empty set rather than a 5xx, so the page shows the honest empty state and never a fabricated key.
-     * @summary Returns the caller\'s own API keys — every type they hold, read AUTHORITATIVELY from IAM rather than from the session claim, which lags a key minted moments ago.
+     * Returns the API keys the caller may see, newest first: their own, or every key the org holds when the caller administers it. Each is its own credential with its own name, prefix, status, expiry and limit. Revoked keys stay listed. No secret material comes back; a publishable key, which is public by construction, carries its full value.
+     * @summary Returns the API keys the caller may see, newest first: their own, or every key the org holds when the caller administers it.
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
      */
     getAccountKeys(options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<AccountApiKeyList>>;
+    /**
+     * Changes one key\'s name, permissions, budget, rate or expiry. The secret is not reissued: the key in your deployment keeps working, under its new policy. Only the person the key belongs to may edit it, and a revoked key cannot be edited.
+     * @summary Changes one key\'s name, permissions, budget, rate or expiry.
+     * @param {string} id ID is the key to edit, from the path.
+     * @param {AccountKeyEdit} accountKeyEdit
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    patchAccountKeysById(id: string, accountKeyEdit: AccountKeyEdit, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<AccountApiKey>>;
     /**
      * Stores the caller\'s appearance preference on their IAM account, preserving every other field of the row. The accent is validated as a real colour token before it is stored; an unset or invalid axis is dropped rather than stored.
      * @summary Stores the caller\'s appearance preference on their IAM account, preserving every other field of the row.
@@ -174,13 +192,13 @@ export declare const AccountApiFp: (configuration?: Configuration) => {
      */
     postAccountAvatar(options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<void>>;
     /**
-     * Creates — or rotates — the caller\'s API key of the requested type and returns it ONCE. A real IAM failure surfaces as 502, never a fabricated key.  Rotating is what creating means here: a user holds one key per type, so the endpoint is idempotent by (caller, type) and the superseded credential stops working. Two live secrets for one user would make \"revoke my key\" a lie.
-     * @summary Creates — or rotates — the caller\'s API key of the requested type and returns it ONCE.
-     * @param {AccountKeyTypeIn} accountKeyTypeIn
+     * Creates a NEW API key and returns its secret ONCE. It never revokes or changes any other key: every key the caller already holds keeps working. The key is filed in the org the caller acts in and names them as its creator.  An org holds at most 1,000 live keys; past that the create is refused until one is revoked.
+     * @summary Creates a NEW API key and returns its secret ONCE.
+     * @param {AccountKeyIn} accountKeyIn
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
      */
-    postAccountKeys(accountKeyTypeIn: AccountKeyTypeIn, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<AccountMintedKey>>;
+    postAccountKeys(accountKeyIn: AccountKeyIn, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<AccountApiKey>>;
     /**
      * Creates the caller\'s organization. Two flows, keyed on whether the caller already has a home org (mirrors app/onboard/route.ts):    - FIRST-RUN (no home org): create + MOVE the user in as admin, so their next     JWT carries the new owner and the cloud scopes everything to it. This is the     path a fresh OAuth sign-up takes, from the sign-up application\'s org.   - ADDITIONAL (owner set): create the org but do NOT move the user — a move     changes their IAM owner (stripping a SuperAdmin\'s status + orphaning their     current org). They reach the new org via the OrgSwitcher, which re-scopes     X-Org-Id without touching IAM membership. A personal-org request from someone     who already has an org is meaningless → 409.
      * @summary Creates the caller\'s organization.
@@ -196,13 +214,13 @@ export declare const AccountApiFp: (configuration?: Configuration) => {
  */
 export declare const AccountApiFactory: (configuration?: Configuration, basePath?: string, axios?: AxiosInstance) => {
     /**
-     * Revokes the caller\'s own API key of the requested class. The class is the same field mint takes — `?type=publishable`, defaulting to secret — so revoking the key that ships in a browser bundle does not sign its holder out of their own API: the other key keeps working.  Revoking is how a key is replaced when it does not need replacing; minting the same class again rotates it in one step. IAM drops the credential immediately, but cloud caches a home key\'s principal for up to 60s, so a request inside that window may still be served. A member\'s key is never cached.  For callers written against the older shape, the class is also accepted in a JSON request body, read only when `?type=` is absent.
-     * @summary Revokes the caller\'s own API key of the requested class.
-     * @param {AccountApiDeleteAccountKeysRequest} requestParameters Request parameters.
+     * Revokes exactly one API key, by id. Every other key keeps working. The key stays listed as revoked, with who revoked it and when, and can never be used again. IAM refuses it at once; cloud caches a resolved key for up to 60 seconds, so a request inside that window may still be served.  A member revokes their own keys; an org admin revokes any of the org\'s, and revoking someone else\'s is recorded on the audit trail.
+     * @summary Revokes exactly one API key, by id.
+     * @param {AccountApiDeleteAccountKeysByIdRequest} requestParameters Request parameters.
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
      */
-    deleteAccountKeys(requestParameters?: AccountApiDeleteAccountKeysRequest, options?: RawAxiosRequestConfig): AxiosPromise<AccountRevokedKey>;
+    deleteAccountKeysById(requestParameters: AccountApiDeleteAccountKeysByIdRequest, options?: RawAxiosRequestConfig): AxiosPromise<AccountApiKey>;
     /**
      * Returns the signed-in caller\'s own appearance preference — text size, density and accent — read from their IAM account so it is the same on every device and every Hanzo surface. An unset preference is an empty object.  A transient IAM read failure reports the empty preference rather than a 5xx, so a surface applies its published default and never error-toasts on load — the same fail-soft the key read uses.
      * @summary Returns the signed-in caller\'s own appearance preference — text size, density and accent — read from their IAM account so it is the same on every device and every Hanzo surface.
@@ -234,12 +252,20 @@ export declare const AccountApiFactory: (configuration?: Configuration, basePath
      */
     getAccountEmbed(requestParameters?: AccountApiGetAccountEmbedRequest, options?: RawAxiosRequestConfig): AxiosPromise<AccountEmbedStatusResp>;
     /**
-     * Returns the caller\'s own API keys — every type they hold, read AUTHORITATIVELY from IAM rather than from the session claim, which lags a key minted moments ago. No secret material comes back: a secret key is represented by its prefix, and only a publishable key (public by construction) carries its full value.  A transient IAM read failure reports an empty set rather than a 5xx, so the page shows the honest empty state and never a fabricated key.
-     * @summary Returns the caller\'s own API keys — every type they hold, read AUTHORITATIVELY from IAM rather than from the session claim, which lags a key minted moments ago.
+     * Returns the API keys the caller may see, newest first: their own, or every key the org holds when the caller administers it. Each is its own credential with its own name, prefix, status, expiry and limit. Revoked keys stay listed. No secret material comes back; a publishable key, which is public by construction, carries its full value.
+     * @summary Returns the API keys the caller may see, newest first: their own, or every key the org holds when the caller administers it.
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
      */
     getAccountKeys(options?: RawAxiosRequestConfig): AxiosPromise<AccountApiKeyList>;
+    /**
+     * Changes one key\'s name, permissions, budget, rate or expiry. The secret is not reissued: the key in your deployment keeps working, under its new policy. Only the person the key belongs to may edit it, and a revoked key cannot be edited.
+     * @summary Changes one key\'s name, permissions, budget, rate or expiry.
+     * @param {AccountApiPatchAccountKeysByIdRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    patchAccountKeysById(requestParameters: AccountApiPatchAccountKeysByIdRequest, options?: RawAxiosRequestConfig): AxiosPromise<AccountApiKey>;
     /**
      * Stores the caller\'s appearance preference on their IAM account, preserving every other field of the row. The accent is validated as a real colour token before it is stored; an unset or invalid axis is dropped rather than stored.
      * @summary Stores the caller\'s appearance preference on their IAM account, preserving every other field of the row.
@@ -256,13 +282,13 @@ export declare const AccountApiFactory: (configuration?: Configuration, basePath
      */
     postAccountAvatar(options?: RawAxiosRequestConfig): AxiosPromise<void>;
     /**
-     * Creates — or rotates — the caller\'s API key of the requested type and returns it ONCE. A real IAM failure surfaces as 502, never a fabricated key.  Rotating is what creating means here: a user holds one key per type, so the endpoint is idempotent by (caller, type) and the superseded credential stops working. Two live secrets for one user would make \"revoke my key\" a lie.
-     * @summary Creates — or rotates — the caller\'s API key of the requested type and returns it ONCE.
+     * Creates a NEW API key and returns its secret ONCE. It never revokes or changes any other key: every key the caller already holds keeps working. The key is filed in the org the caller acts in and names them as its creator.  An org holds at most 1,000 live keys; past that the create is refused until one is revoked.
+     * @summary Creates a NEW API key and returns its secret ONCE.
      * @param {AccountApiPostAccountKeysRequest} requestParameters Request parameters.
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
      */
-    postAccountKeys(requestParameters: AccountApiPostAccountKeysRequest, options?: RawAxiosRequestConfig): AxiosPromise<AccountMintedKey>;
+    postAccountKeys(requestParameters: AccountApiPostAccountKeysRequest, options?: RawAxiosRequestConfig): AxiosPromise<AccountApiKey>;
     /**
      * Creates the caller\'s organization. Two flows, keyed on whether the caller already has a home org (mirrors app/onboard/route.ts):    - FIRST-RUN (no home org): create + MOVE the user in as admin, so their next     JWT carries the new owner and the cloud scopes everything to it. This is the     path a fresh OAuth sign-up takes, from the sign-up application\'s org.   - ADDITIONAL (owner set): create the org but do NOT move the user — a move     changes their IAM owner (stripping a SuperAdmin\'s status + orphaning their     current org). They reach the new org via the OrgSwitcher, which re-scopes     X-Org-Id without touching IAM membership. A personal-org request from someone     who already has an org is meaningless → 409.
      * @summary Creates the caller\'s organization.
@@ -273,17 +299,17 @@ export declare const AccountApiFactory: (configuration?: Configuration, basePath
     postAccountOrgs(requestParameters: AccountApiPostAccountOrgsRequest, options?: RawAxiosRequestConfig): AxiosPromise<AccountOnboardResp>;
 };
 /**
- * Request parameters for deleteAccountKeys operation in AccountApi.
+ * Request parameters for deleteAccountKeysById operation in AccountApi.
  * @export
- * @interface AccountApiDeleteAccountKeysRequest
+ * @interface AccountApiDeleteAccountKeysByIdRequest
  */
-export interface AccountApiDeleteAccountKeysRequest {
+export interface AccountApiDeleteAccountKeysByIdRequest {
     /**
-     * Type is the key class to act on: \&quot;secret\&quot; (sk-, session-equivalent, belongs on a server) or \&quot;publishable\&quot; (pk-, org-identifying, safe in a browser bundle). Omitted means secret, which is what every existing caller means.
+     * ID is the key to act on, from the path.
      * @type {string}
-     * @memberof AccountApiDeleteAccountKeys
+     * @memberof AccountApiDeleteAccountKeysById
      */
-    readonly type?: string;
+    readonly id: string;
 }
 /**
  * Request parameters for getAccountAvatarByOrgByUserByDigest operation in AccountApi.
@@ -323,6 +349,25 @@ export interface AccountApiGetAccountEmbedRequest {
      */
     readonly app?: string;
 }
+/**
+ * Request parameters for patchAccountKeysById operation in AccountApi.
+ * @export
+ * @interface AccountApiPatchAccountKeysByIdRequest
+ */
+export interface AccountApiPatchAccountKeysByIdRequest {
+    /**
+     * ID is the key to edit, from the path.
+     * @type {string}
+     * @memberof AccountApiPatchAccountKeysById
+     */
+    readonly id: string;
+    /**
+     *
+     * @type {AccountKeyEdit}
+     * @memberof AccountApiPatchAccountKeysById
+     */
+    readonly accountKeyEdit: AccountKeyEdit;
+}
 /**
  * Request parameters for postAccountAppearance operation in AccountApi.
  * @export
@@ -344,10 +389,10 @@ export interface AccountApiPostAccountAppearanceRequest {
 export interface AccountApiPostAccountKeysRequest {
     /**
      *
-     * @type {AccountKeyTypeIn}
+     * @type {AccountKeyIn}
      * @memberof AccountApiPostAccountKeys
      */
-    readonly accountKeyTypeIn: AccountKeyTypeIn;
+    readonly accountKeyIn: AccountKeyIn;
 }
 /**
  * Request parameters for postAccountOrgs operation in AccountApi.
@@ -370,14 +415,14 @@ export interface AccountApiPostAccountOrgsRequest {
  */
 export declare class AccountApi extends BaseAPI {
     /**
-     * Revokes the caller\'s own API key of the requested class. The class is the same field mint takes — `?type=publishable`, defaulting to secret — so revoking the key that ships in a browser bundle does not sign its holder out of their own API: the other key keeps working.  Revoking is how a key is replaced when it does not need replacing; minting the same class again rotates it in one step. IAM drops the credential immediately, but cloud caches a home key\'s principal for up to 60s, so a request inside that window may still be served. A member\'s key is never cached.  For callers written against the older shape, the class is also accepted in a JSON request body, read only when `?type=` is absent.
-     * @summary Revokes the caller\'s own API key of the requested class.
-     * @param {AccountApiDeleteAccountKeysRequest} requestParameters Request parameters.
+     * Revokes exactly one API key, by id. Every other key keeps working. The key stays listed as revoked, with who revoked it and when, and can never be used again. IAM refuses it at once; cloud caches a resolved key for up to 60 seconds, so a request inside that window may still be served.  A member revokes their own keys; an org admin revokes any of the org\'s, and revoking someone else\'s is recorded on the audit trail.
+     * @summary Revokes exactly one API key, by id.
+     * @param {AccountApiDeleteAccountKeysByIdRequest} requestParameters Request parameters.
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
      * @memberof AccountApi
      */
-    deleteAccountKeys(requestParameters?: AccountApiDeleteAccountKeysRequest, options?: RawAxiosRequestConfig): Promise<globalAxios.AxiosResponse<AccountRevokedKey, any, {}>>;
+    deleteAccountKeysById(requestParameters: AccountApiDeleteAccountKeysByIdRequest, options?: RawAxiosRequestConfig): Promise<globalAxios.AxiosResponse<AccountApiKey, any, {}>>;
     /**
      * Returns the signed-in caller\'s own appearance preference — text size, density and accent — read from their IAM account so it is the same on every device and every Hanzo surface. An unset preference is an empty object.  A transient IAM read failure reports the empty preference rather than a 5xx, so a surface applies its published default and never error-toasts on load — the same fail-soft the key read uses.
      * @summary Returns the signed-in caller\'s own appearance preference — text size, density and accent — read from their IAM account so it is the same on every device and every Hanzo surface.
@@ -413,13 +458,22 @@ export declare class AccountApi extends BaseAPI {
      */
     getAccountEmbed(requestParameters?: AccountApiGetAccountEmbedRequest, options?: RawAxiosRequestConfig): Promise<globalAxios.AxiosResponse<AccountEmbedStatusResp, any, {}>>;
     /**
-     * Returns the caller\'s own API keys — every type they hold, read AUTHORITATIVELY from IAM rather than from the session claim, which lags a key minted moments ago. No secret material comes back: a secret key is represented by its prefix, and only a publishable key (public by construction) carries its full value.  A transient IAM read failure reports an empty set rather than a 5xx, so the page shows the honest empty state and never a fabricated key.
-     * @summary Returns the caller\'s own API keys — every type they hold, read AUTHORITATIVELY from IAM rather than from the session claim, which lags a key minted moments ago.
+     * Returns the API keys the caller may see, newest first: their own, or every key the org holds when the caller administers it. Each is its own credential with its own name, prefix, status, expiry and limit. Revoked keys stay listed. No secret material comes back; a publishable key, which is public by construction, carries its full value.
+     * @summary Returns the API keys the caller may see, newest first: their own, or every key the org holds when the caller administers it.
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
      * @memberof AccountApi
      */
     getAccountKeys(options?: RawAxiosRequestConfig): Promise<globalAxios.AxiosResponse<AccountApiKeyList, any, {}>>;
+    /**
+     * Changes one key\'s name, permissions, budget, rate or expiry. The secret is not reissued: the key in your deployment keeps working, under its new policy. Only the person the key belongs to may edit it, and a revoked key cannot be edited.
+     * @summary Changes one key\'s name, permissions, budget, rate or expiry.
+     * @param {AccountApiPatchAccountKeysByIdRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof AccountApi
+     */
+    patchAccountKeysById(requestParameters: AccountApiPatchAccountKeysByIdRequest, options?: RawAxiosRequestConfig): Promise<globalAxios.AxiosResponse<AccountApiKey, any, {}>>;
     /**
      * Stores the caller\'s appearance preference on their IAM account, preserving every other field of the row. The accent is validated as a real colour token before it is stored; an unset or invalid axis is dropped rather than stored.
      * @summary Stores the caller\'s appearance preference on their IAM account, preserving every other field of the row.
@@ -438,14 +492,14 @@ export declare class AccountApi extends BaseAPI {
      */
     postAccountAvatar(options?: RawAxiosRequestConfig): Promise<globalAxios.AxiosResponse<void, any, {}>>;
     /**
-     * Creates — or rotates — the caller\'s API key of the requested type and returns it ONCE. A real IAM failure surfaces as 502, never a fabricated key.  Rotating is what creating means here: a user holds one key per type, so the endpoint is idempotent by (caller, type) and the superseded credential stops working. Two live secrets for one user would make \"revoke my key\" a lie.
-     * @summary Creates — or rotates — the caller\'s API key of the requested type and returns it ONCE.
+     * Creates a NEW API key and returns its secret ONCE. It never revokes or changes any other key: every key the caller already holds keeps working. The key is filed in the org the caller acts in and names them as its creator.  An org holds at most 1,000 live keys; past that the create is refused until one is revoked.
+     * @summary Creates a NEW API key and returns its secret ONCE.
      * @param {AccountApiPostAccountKeysRequest} requestParameters Request parameters.
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
      * @memberof AccountApi
      */
-    postAccountKeys(requestParameters: AccountApiPostAccountKeysRequest, options?: RawAxiosRequestConfig): Promise<globalAxios.AxiosResponse<AccountMintedKey, any, {}>>;
+    postAccountKeys(requestParameters: AccountApiPostAccountKeysRequest, options?: RawAxiosRequestConfig): Promise<globalAxios.AxiosResponse<AccountApiKey, any, {}>>;
     /**
      * Creates the caller\'s organization. Two flows, keyed on whether the caller already has a home org (mirrors app/onboard/route.ts):    - FIRST-RUN (no home org): create + MOVE the user in as admin, so their next     JWT carries the new owner and the cloud scopes everything to it. This is the     path a fresh OAuth sign-up takes, from the sign-up application\'s org.   - ADDITIONAL (owner set): create the org but do NOT move the user — a move     changes their IAM owner (stripping a SuperAdmin\'s status + orphaning their     current org). They reach the new org via the OrgSwitcher, which re-scopes     X-Org-Id without touching IAM membership. A personal-org request from someone     who already has an org is meaningless → 409.
      * @summary Creates the caller\'s organization.