ApiKeyService
class ApiKeyService (View source)
Creates, regenerates, disables and deletes API keys and enforces the per-user key limit.
Methods
ApiKeyService constructor
Get all API keys the current user has access to with creator usernames
Create a new API key
Update an existing API key
Delete an API key
Regenerate the secret key for an API key
Toggle the disabled status of an API key
Authenticate a request using an API key
Get user ID from API key without setting session (stateless).
Get the api_keys row id from a raw secret key without setting session (stateless).
Resolve the permission scope of an API key (stateless, no session writes).
Whether zone restrictions can be shown and changed; false until the one-time scope move has run (see ApiKeyRepositoryInterface::zoneScopesReady()).
Whether the key keeps a zone restriction the zone id upgrade could not map; it is stored as zone id 0, which matches no zone, and the edit form cannot show it as selected.
Details
__construct(ApiKeyRepositoryInterface $apiKeyRepository, UserLookupInterface $users, ConfigurationInterface $config, PermissionService $permissionService, ActorInterface $actor, LoggerInterface|null $logger = null)
ApiKeyService constructor
array
getAllApiKeys()
Get all API keys the current user has access to with creator usernames
ApiKey|null
getApiKey(int $id)
Get a specific API key if the current user has access to it
ApiKeyWriteResult
createApiKey(string $name, DateTime|null $expiresAt = null, bool $isReadonly = false, array|null $allowedOperations = null, array $zoneIds = [])
Create a new API key
ApiKeyWriteResult
updateApiKey(int $id, string $name, DateTime|null $expiresAt = null, bool $disabled = false, bool $isReadonly = false, array|null $allowedOperations = null, array|null $zoneIds = null)
Update an existing API key
ApiKeyWriteResult
deleteApiKey(int $id)
Delete an API key
ApiKeyWriteResult
regenerateSecretKey(int $id)
Regenerate the secret key for an API key
ApiKeyWriteResult
toggleApiKey(int $id, bool $disabled)
Toggle the disabled status of an API key
bool
authenticate(string $secretKey)
Authenticate a request using an API key
int
getUserIdFromApiKey(string $secretKey)
Get user ID from API key without setting session (stateless).
int|null
getIdFromApiKey(string $secretKey)
Get the api_keys row id from a raw secret key without setting session (stateless).
Used for audit logging so a request can be traced back to a specific key.
ApiKeyScope|null
getScopeFromApiKey(string $secretKey)
Resolve the permission scope of an API key (stateless, no session writes).
Returns null when the key is missing/invalid or the API is disabled, in which case the caller should fall back to an unrestricted scope (the key is already rejected by authentication). A key with no restrictions yields a scope where every zone and operation is allowed.
bool
zoneScopesReady()
Whether zone restrictions can be shown and changed; false until the one-time scope move has run (see ApiKeyRepositoryInterface::zoneScopesReady()).
static bool
hasUnmappedZoneScope(ApiKey $apiKey)
Whether the key keeps a zone restriction the zone id upgrade could not map; it is stored as zone id 0, which matches no zone, and the edit form cannot show it as selected.