API reference: API keys

Create, list and revoke account API keys. Keys are shown once and sent in the x-api-key header.

Method	Path	What it does
`POST`	`/v1/accounts/{accountId}/api-keys`	Create an API key The raw key (dfx_live_…) is returned ONCE in this response and never again.
`GET`	`/v1/accounts/{accountId}/api-keys`	List API keys (prefix, name, lastUsed, scopes — never the secret)
`DELETE`	`/v1/accounts/{accountId}/api-keys/{keyId}`	Revoke an API key

Conventions

Base URL: https://api.docuflex.net; tenant routes are /v1/accounts/{accountId}/....
Auth: x-api-key: dfx_live_..., or Authorization: Bearer <OAuth2 access token>.
Errors: always {"error":{"code","message","details","requestId"}}; the requestId is also in the x-request-id header.
Pagination: offset (?page=&pageSize=, max 100) or cursor (?cursor=&limit=, follow nextCursor until hasMore is false).
Idempotency: any POST or PUT accepts Idempotency-Key; same key + different body is 409 IDEMPOTENCY_KEY_REUSED.
Rate limits: X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset on every response; 429 RATE_LIMITED with Retry-After.
Tabs: coordinates are fractions of the page (origin top-left); documentIndex and recipientIndex refer to positions in the same request.
Spec: /openapi.json (OpenAPI 3). TypeScript client @docuflex/sdk; Postman and Bruno collections ship with the repo.