# API keys

> Every API key and machine-user query and mutation.

Product: Clad API
Source: https://docs.useclad.ai/api/reference-api-keys

---

Manage programmatic access itself: API keys and the machine users (API principals) they belong to.

### Queries

#### `apiKeys`

```graphql
apiKeys(machineUserId: ID): [ApiKey!]
```

API key metadata (never secrets), optionally filtered to one machine user.

| Argument | Type | Description |
| --- | --- | --- |
| `machineUserId` | `ID` |  |

#### `machineUsers`

```graphql
machineUsers: [MachineUser!]
```

Service accounts in this organization.

### Mutations

#### `createApiKey`

```graphql
createApiKey(input: CreateApiKeyInput!): CreateApiKeyResult
```

Mint an API key for a service account. Human org admins only; the secret is returned exactly once.

| Argument | Type | Description |
| --- | --- | --- |
| `input` | `CreateApiKeyInput!` | Required. |

#### `createMachineUser`

```graphql
createMachineUser(input: CreateMachineUserInput!): MachineUserResult
```

Create a service account. Human org admins only.

| Argument | Type | Description |
| --- | --- | --- |
| `input` | `CreateMachineUserInput!` | Required. |

#### `revokeApiKey`

```graphql
revokeApiKey(id: ID!): ApiKeyResult
```

Revoke an API key immediately. Requires apikeys:revoke (admin-gated).

| Argument | Type | Description |
| --- | --- | --- |
| `id` | `ID!` | Required. |

#### `setMachineUserActive`

```graphql
setMachineUserActive(id: ID!, isActive: Boolean!): MachineUserResult
```

Enable/disable a service account (disabling blocks all of its keys). Human org admins only.

| Argument | Type | Description |
| --- | --- | --- |
| `id` | `ID!` | Required. |
| `isActive` | `Boolean!` | Required. |