[GA] Publish SDK and API contract for public-key registration and approval#192
Merged
Conversation
📋 View the side-by-side API change reviewThe link expires in 7 days. 🔒 Your API specs are encrypted in CI before they're uploaded. The decryption key stays in this link's URL fragment (after the #), which browsers never send to a server, so oasdiff cannot read your specs. How it works → Posted automatically by the oasdiff GitHub Action. To turn this off (no spec upload, no comment), set |
✨ API Changes# API Changelog n/a vs. n/a
## API Changes
### GET /v0/api-keys/public-keys
- endpoint added
### POST /v0/api-keys/public-keys
- endpoint added
### POST /v0/api-keys/public-keys/agentid-sign-in/revoke-all
- endpoint added
### DELETE /v0/api-keys/public-keys/{api_key_id}
- endpoint added
### PATCH /v0/api-keys/public-keys/{api_key_id}
- endpoint added💡 Download |
✨ API Changes# API Changelog n/a vs. n/a
## API Changes
### GET /v0/api-keys
- added the optional property `api_keys/items/permissions/api_key_update` to the response with the `200` status
### POST /v0/api-keys
- added the new optional request property `permissions/api_key_update`
- added the optional property `permissions/api_key_update` to the response with the `200` status
### GET /v0/api-keys/public-keys
- endpoint added
### POST /v0/api-keys/public-keys
- endpoint added
### POST /v0/api-keys/public-keys/agentid-sign-in/revoke-all
- endpoint added
### DELETE /v0/api-keys/public-keys/{api_key_id}
- endpoint added
### PATCH /v0/api-keys/public-keys/{api_key_id}
- endpoint added
### GET /v0/inboxes/{inbox_id}/api-keys
- added the optional property `api_keys/items/permissions/api_key_update` to the response with the `200` status
### POST /v0/inboxes/{inbox_id}/api-keys
- added the new optional request property `permissions/api_key_update`
- added the optional property `permissions/api_key_update` to the response with the `200` status
### GET /v0/pods/{pod_id}/api-keys
- added the optional property `api_keys/items/permissions/api_key_update` to the response with the `200` status
### POST /v0/pods/{pod_id}/api-keys
- added the new optional request property `permissions/api_key_update`
- added the optional property `permissions/api_key_update` to the response with the `200` status💡 Download |
- guide: "stable cookie binding" -> "per-transaction cookie binding" to match the random per-transaction transaction cookie the backend sets - changelog: separate auth.agentid.com/authorize/approve from the Fern/SDK endpoints, noting it is issuer-served and called directly Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
✨ API Changes# API Changelog n/a vs. n/a
## API Changes
### GET /v0/api-keys
- added the optional property `api_keys/items/permissions/api_key_update` to the response with the `200` status
### POST /v0/api-keys
- added the new optional request property `permissions/api_key_update`
- added the optional property `permissions/api_key_update` to the response with the `200` status
### GET /v0/api-keys/public-keys
- endpoint added
### POST /v0/api-keys/public-keys
- endpoint added
### POST /v0/api-keys/public-keys/agentid-sign-in/revoke-all
- endpoint added
### DELETE /v0/api-keys/public-keys/{api_key_id}
- endpoint added
### PATCH /v0/api-keys/public-keys/{api_key_id}
- endpoint added
### GET /v0/inboxes/{inbox_id}/api-keys
- added the optional property `api_keys/items/permissions/api_key_update` to the response with the `200` status
### POST /v0/inboxes/{inbox_id}/api-keys
- added the new optional request property `permissions/api_key_update`
- added the optional property `permissions/api_key_update` to the response with the `200` status
### GET /v0/pods/{pod_id}/api-keys
- added the optional property `api_keys/items/permissions/api_key_update` to the response with the `200` status
### POST /v0/pods/{pod_id}/api-keys
- added the new optional request property `permissions/api_key_update`
- added the optional property `permissions/api_key_update` to the response with the `200` status💡 Download |
✨ API Changes# API Changelog n/a vs. n/a
## API Changes
### GET /v0/api-keys
- added the optional property `api_keys/items/permissions/api_key_update` to the response with the `200` status
### POST /v0/api-keys
- added the new optional request property `permissions/api_key_update`
- added the optional property `permissions/api_key_update` to the response with the `200` status
### GET /v0/api-keys/public-keys
- endpoint added
### POST /v0/api-keys/public-keys
- endpoint added
### POST /v0/api-keys/public-keys/agentid-sign-in/revoke-all
- endpoint added
### DELETE /v0/api-keys/public-keys/{api_key_id}
- endpoint added
### PATCH /v0/api-keys/public-keys/{api_key_id}
- endpoint added
### GET /v0/inboxes/{inbox_id}/api-keys
- added the optional property `api_keys/items/permissions/api_key_update` to the response with the `200` status
### POST /v0/inboxes/{inbox_id}/api-keys
- added the new optional request property `permissions/api_key_update`
- added the optional property `permissions/api_key_update` to the response with the `200` status
### GET /v0/pods/{pod_id}/api-keys
- added the optional property `api_keys/items/permissions/api_key_update` to the response with the `200` status
### POST /v0/pods/{pod_id}/api-keys
- added the new optional request property `permissions/api_key_update`
- added the optional property `permissions/api_key_update` to the response with the `200` status💡 Download |
shalim786
marked this pull request as ready for review
July 20, 2026 21:59
duharry0915
approved these changes
Jul 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
/api-keys/public-keysWhy
Customer enablement for AgentID key-pair authentication needs a generated SDK/API contract that matches the merged backend handlers. Callers must be able to register only public key material, store the returned
api_key_idaskid, and submit one narrowly-scoped ES256 approval without exposing bearer or private-key credentials.Developer impact
Generated Python and TypeScript clients gain dedicated list, create, rename, single-revoke, and revoke-all methods. Legacy
/api-keyscreate/list/delete request models remain bearer-only and cannot carry a public JWK or caller-selected credential type.The guide includes complete helper implementations and operational guidance for organization, pod, and inbox scopes; expiry inheritance; create-new/delete-old rotation; revoke-all idempotency; and keeping private keys below model context.
Validation
npx -y fern-api@4.63.0 check— passed with 0 errorsnpm run lint— passedgit diff --check— passedRepository note
fern check --strict-broken-linksstill reports 11 pre-existing broken links in unrelated existing pages. The new guide introduced no broken-link finding.