What you can do here
Everything below uses the public management API. Pick a region, paste a management key, and every action shows the request it sends.
Scopes
Management keys carry explicit scopes. No scope implies another.
| Scope | Allows |
|---|---|
read | Capabilities and the spec, app, provider, quota pool and key metadata, prompts, history, audit, catalogs and operation status. |
config:write | App settings and availability, provider attachments and conversion, prompts, configuration rollback and operation recovery. |
providers:write | Create, update, enable, disable and delete shared providers, manage quota pools, and run provider tests and model discovery. |
credentials:write | Issue gateway keys, change their expiry and revoke them. Creating an app needs this and config:write. |
credentials:read | Reveal the secret of one active gateway key, on explicit request. |
budgets:read | Budgets, usage, subjects, grants, pricing, exemptions, alerts and budget events. |
budgets:policy | Budget, pricing and exemption edits (each publishes a policy revision) and alert destinations. |
budgets:grant | Create, change and revoke time-boxed budget grants. |
Operations by area
Counts exclude alias routes. Open the API Explorer for the full list.
| Area | Operations | Your key can call |
|---|---|---|
| Reference | 2 | - |
| Apps | 8 | - |
| Providers | 10 | - |
| Quota pools | 5 | - |
| Credentials | 6 | - |
| Prompts | 4 | - |
| Budgets | 27 | - |
| Catalogs | 4 | - |
| History | 6 | - |
| Administration | 6 | Tenant-admin token |