API reference

IAM

Organization API keys and credential verification for your One account organization.

Operations: 4
Base path: https://os.one.ml/api/v1/iam
Scopes: iam:read iam:write
API keys: 3 need a signed-in session · 1 not yet tested
SDK: genesis.call('iam_revokeApiKey', …)
CLI: Through genesis --json and the SDK
MCP: 4 tools

Operations

Operation	Endpoint	API key
Revoke API key	DELETE`/api-keys/{key_id}`	Signed-in session
List organization API keys	GET`/organizations/{org_id}/api-keys`	Signed-in session
Create organization API key	POST`/organizations/{org_id}/api-keys`	Signed-in session
Request scoped Runner self-execution permission	POST`/runner/self-execution-grant`	—

Api keys

Revoke API key

DELETE/v1/iam/api-keys/{key_id}

iam:writeSigned-in sessioniam_revokeApiKey

Revocation is honored within 60 seconds due to caching.

Parameters

key_idpath · stringrequired

Responses

204API key revoked
401Unauthorized
403Forbidden
404Not found
503Service unavailable
4xx 5xxThe error envelope.

curl -X DELETE "https://os.one.ml/api/v1/iam/api-keys/$KEY_ID" \
  -H "Authorization: Bearer $GENESIS_API_KEY"

import { Genesis } from '@lifesi/genesis'

const genesis = new Genesis({ apiKey: process.env.GENESIS_API_KEY })
const result = await genesis.call('iam_revokeApiKey', {
  key_id: '<key_id>',
})

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "iam_revokeApiKey",
    "arguments": {
      "key_id": "<key_id>"
    }
  }
}

List organization API keys

GET/v1/iam/organizations/{org_id}/api-keys

iam:readSigned-in sessioniam_listOrgApiKeys

Parameters

org_idpath · stringrequired

Responses

200List of API keys
Response fields
- object"list"required
- dataobject[]required
- data[].[].idstringrequired
- data[].[].namestringrequired
- data[].[].obfuscated_valuestringrequired
- data[].[].scopesstring[]required
- data[].[].last_used_atstring | null (date-time)
- data[].[].expires_atstring | null (date-time)
- data[].[].created_atstring (date-time)required
- data[].[].updated_atstring (date-time)required
401Unauthorized
403Forbidden
503Service unavailable
4xx 5xxThe error envelope.

curl "https://os.one.ml/api/v1/iam/organizations/$ORG_ID/api-keys" \
  -H "Authorization: Bearer $GENESIS_API_KEY"

import { Genesis } from '@lifesi/genesis'

const genesis = new Genesis({ apiKey: process.env.GENESIS_API_KEY })
const result = await genesis.call('iam_listOrgApiKeys', {
  org_id: '<org_id>',
})

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "iam_listOrgApiKeys",
    "arguments": {
      "org_id": "<org_id>"
    }
  }
}

Create organization API key

POST/v1/iam/organizations/{org_id}/api-keys

iam:writeSigned-in sessioniam_createOrgApiKey

Requires org admin or owner role. The full key value is only returned once (custody=reveal).

Parameters

org_idpath · stringrequired

Request body application/json

namestringrequired
min length 1 · max length 255
scopesstring[]
custody"reveal" | "blinds"
default "reveal"
expires_atstring (date-time)

Responses

201API key created
Response fields
- idstringrequired
- namestringrequired
- obfuscated_valuestringrequired
- valuestring | null
- blinds_credential_refstring | null
- scopesstring[]required
- expires_atstring | null (date-time)
- created_atstring (date-time)required
400Bad request
401Unauthorized
403Forbidden
503Service unavailable
4xx 5xxThe error envelope.

curl -X POST "https://os.one.ml/api/v1/iam/organizations/$ORG_ID/api-keys" \
  -H "Authorization: Bearer $GENESIS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "string"
  }'

import { Genesis } from '@lifesi/genesis'

const genesis = new Genesis({ apiKey: process.env.GENESIS_API_KEY })
const result = await genesis.call('iam_createOrgApiKey', {
  org_id: '<org_id>',
  body: {
    name: 'string',
  },
})

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "iam_createOrgApiKey",
    "arguments": {
      "org_id": "<org_id>",
      "body": {
        "name": "string"
      }
    }
  }
}

Runner

Request scoped Runner self-execution permission

POST/v1/iam/runner/self-execution-grant

iam:writeIdempotency-Key requirediam_runnerSelfExecutionGrant

Requires an actual ordinary interactive human session and current native organization owner or qualifying manager authority. Explicit null fleet, Sandbox, full signed selection and finite expiry only. Preserve operationId, scope and expiry on replay; requestId is fresh correlation. Backend deployment and gateway activation remain required.

Parameters

Idempotency-Keyheader · string (uuid)required
Exact body operationId
x-request-idheader · string (uuid)required
Exact body requestId; the gateway translates it to the native correlation header

Request body application/json

schemaVersion1required
requestIdstringrequired
pattern ^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
operationIdstringrequired
pattern ^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
organizationIdstringrequired
pattern ^o_[A-Za-z0-9_]{1,32}$
projectIdstringrequired
pattern ^pr_[A-Za-z0-9_]{1,32}$
platformId"pf_console"required
workspaceIdstringrequired
pattern ^w_[A-Za-z0-9_]{1,32}$
fleetIdnullrequired
resourceEnvironment"sandbox"required
expiresAtMsintegerrequired
min 1 · max 9007199254740991

Responses

200Exact scoped native grant
Response fields
- idstringrequired
  pattern ^g_[0-7][0123456789ABCDEFGHJKMNPQRSTVWXYZ]{25}$
- principal_idstringrequired
  pattern ^h_[A-Za-z0-9_]{1,32}$
- organization_idstringrequired
  pattern ^o_[A-Za-z0-9_]{1,32}$
- project_idstringrequired
  pattern ^pr_[A-Za-z0-9_]{1,32}$
- platform_id"pf_console"required
- workspace_idstringrequired
  pattern ^w_[A-Za-z0-9_]{1,32}$
- environmentId"sandbox"required
- role_idsany[]required
- permissions"runner.tasks.execute"[]required
- expires_atintegerrequired
  min 1 · max 9007199254740991
- created_atintegerrequired
  min 1 · max 9007199254740991
400Closed invalid request or expiry error
401Current human authority inactive
403Current native authority denied
409Changed operation payload or stale retained grant
503Native authority or store unavailable
4xx 5xxThe error envelope.

curl -X POST "https://os.one.ml/api/v1/iam/runner/self-execution-grant" \
  -H "Authorization: Bearer $GENESIS_API_KEY" \
  -H "Idempotency-Key: $IDEMPOTENCY_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "schemaVersion": 1,
    "requestId": "string",
    "operationId": "string",
    "organizationId": "string",
    "projectId": "string",
    "platformId": "pf_console",
    "workspaceId": "string",
    "fleetId": "string",
    "resourceEnvironment": "sandbox",
    "expiresAtMs": 1
  }'

import { Genesis } from '@lifesi/genesis'

const genesis = new Genesis({ apiKey: process.env.GENESIS_API_KEY })
const idempotencyKey = '<a stable key per change>'
const result = await genesis.call('iam_runnerSelfExecutionGrant', {
  body: {
    schemaVersion: 1,
    requestId: 'string',
    operationId: 'string',
    organizationId: 'string',
    projectId: 'string',
    platformId: 'pf_console',
    workspaceId: 'string',
    fleetId: 'string',
    resourceEnvironment: 'sandbox',
    expiresAtMs: 1,
  },
}, {
  headers: { 'Idempotency-Key': idempotencyKey }, // one key per change, reused on every retry
})

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "iam_runnerSelfExecutionGrant",
    "arguments": {
      "body": {
        "schemaVersion": 1,
        "requestId": "string",
        "operationId": "string",
        "organizationId": "string",
        "projectId": "string",
        "platformId": "pf_console",
        "workspaceId": "string",
        "fleetId": "string",
        "resourceEnvironment": "sandbox",
        "expiresAtMs": 1
      },
      "idempotency_key": "<a stable key per change>"
    }
  }
}

One Superintelligence, Inc. · Built from Genesis 0.1.12 and the live gateway on 2026-10-20. Support