Offers full lifecycle management of API keys as global resources, allowing you to create, list, retrieve metadata, fetch the raw key string, update mutable fields, delete (with a 30‑day recovery window), undelete, and look up the owning project of a key.
Deletes an API key. Deleted key can be retrieved within 30 days of deletion. Afterward, key will be purged from the project. NOTE: Key is a global resource; hence the only supported value for location is `global`.
name(path, required) — Required. The resource name of the API key to be deleted.
etag(query) — Optional. The etag known to the client for the expected state of the key. This is to be used for optimistic concurrency.
GET
/v2/{name}
Gets the metadata for an API key. The key string of the API key isn't included in the response. NOTE: Key is a global resource; hence the only supported value for location is `global`.
name(path, required) — Required. The resource name of the API key to get.
GET
/v2/keys:lookupKey
Find the parent project and resource name of the API key that matches the key string in the request. If the API key has been purged, resource name will not be set. The service account must have the `apikeys.keys.lookup` permission on the parent project.
keyString(query) — Required. Finds the project that owns the key string value.
PATCH
/v2/{name}
Patches the modifiable fields of an API key. The key string of the API key isn't included in the response. NOTE: Key is a global resource; hence the only supported value for location is `global`.
name(path, required) — Output only. The resource name of the key. The `name` has the form: `projects//locations/global/keys/`. For example: `projects/123456867718/locations/global/keys/b7ff1f9f-8275-410a-94dd-3855ee9b5dd2` NOTE: Key is a global resource; hence the only supported value for location is `global`.
updateMask(query) — The field mask specifies which fields to be updated as part of this request. All other fields are ignored. Mutable fields are: `display_name`, `restrictions`, and `annotations`. If an update mask is not provided, the service treats it as an implied mask equivalent to all allowed fields that are set on the wire. If the field mask has a special value "*", the service treats it equivalent to replace all allowed mutable fields.
GET
/v2/{name}/keyString
Get the key string for an API key. NOTE: Key is a global resource; hence the only supported value for location is `global`.
name(path, required) — Required. The resource name of the API key to be retrieved.
POST
/v2/{name}:undelete
Undeletes an API key which was deleted within 30 days. NOTE: Key is a global resource; hence the only supported value for location is `global`.
name(path, required) — Required. The resource name of the API key to be undeleted.
GET
/v2/{parent}/keys
Lists the API keys owned by a project. The key string of the API key isn't included in the response. NOTE: Key is a global resource; hence the only supported value for location is `global`.
parent(path, required) — Required. Lists all API keys associated with this project.
pageSize(query, limit) — Optional. Specifies the maximum number of results to be returned at a time.
pageToken(query) — Optional. Requests a specific page of results.
showDeleted(query) — Optional. Indicate that keys deleted in the past 30 days should also be returned.
POST
/v2/{parent}/keys
Creates a new API key. NOTE: Key is a global resource; hence the only supported value for location is `global`.
parent(path, required) — Required. The project in which the API key is created.
keyId(query) — User specified key id (optional). If specified, it will become the final component of the key resource name. The id must be unique within the project, must conform with RFC-1034, is restricted to lower-cased letters, and has a maximum length of 63 characters. In another word, the id must match the regular expression: `[a-z]([a-z0-9-]{0,61}[a-z0-9])?`. The id must NOT be a UUID-like string.
