List API keys
A caller without apikey:manage sees only their own keys. Each key is
returned with the configurations it may reach. Not paginated.
Authorizations
A machine credential, qk_ followed by its secret. Only a hash of the
secret is stored, so a key is displayed exactly once, when it is created
or rotated. A key reaches only the configurations it is linked to.
It may also be sent as Authorization: Bearer qk_..., which is
recognised by the prefix.
Response
Keys, each with the configurations it may reach.
The owning user. Classification clearance for this key resolves through this user and their role.
The first twelve characters of the key, which is all that is stored in readable form. Useful for naming a key in a log without quoting the secret.
"qk_Q8oGyqBl3"
Null while the key is usable. Revocation is permanent.
The configurations this key may reach. An empty array means none: the grant is explicit, so a newly minted key cannot touch data until somebody says which data it is for.
Absent, rather than empty, on the response to a rotation, which does not load them.