auth.v1.ApiKeyService
SetAssistantKeys
Create or replace the caller's Polyester AI assistant key set: one ASSISTANT key per enabled account, each bounded by its API policy. One fresh step-up proof covers the whole set, and the change is all or nothing. An entry whose account already has an assistant key with the same public key keeps that key, with its status, and takes the requested policy; any other entry replaces the account's key. Accounts left out of the set have their assistant key revoked. A sub-account entry needs the same access as CreateApiKey: owner, or a role that manages its API keys. The acting caller's root account must have accepted the current terms; otherwise FailedPrecondition with AUTH_TERMS_NOT_ACCEPTED is returned. A policy that allows a money-out action returns FailedPrecondition with AUTH_ASSISTANT_KEY_ACTION_NOT_ALLOWED. A new key is registered only with the registration proof and deadline the assistant issued with it (PrepareAssistantKeys), before that deadline: a missing or failing proof returns InvalidArgument with AUTH_ASSISTANT_KEY_PROOF_INVALID, a passed deadline FailedPrecondition with AUTH_ASSISTANT_KEY_REGISTRATION_EXPIRED, and one more than 15 minutes ahead InvalidArgument with AUTH_ASSISTANT_KEY_DEADLINE_TOO_FAR.
Request
curl --request POST \ \
--url 'https://api.testnet.polyester.com/auth.v1.ApiKeyService/SetAssistantKeys' \
--header 'Content-Type: application/json' \
--header 'Connect-Protocol-Version: 1' \
--data '{
"keys": [
{
"policyId": "1",
"publicKeyEd25519": "AA==",
"registrationDeadline": "2025-01-01T00:00:00Z",
"registrationProof": "AA==",
"subaccountId": "6789012345678"
}
]
}'Responses
{
"apiKeys": [
{
"color": "#7C3AED",
"createdAt": "2025-01-01T00:00:00Z",
"createdByActor": "dashboard",
"expiresAt": "2025-01-01T00:00:00Z",
"icon": "💰",
"ipWhitelist": [
"203.0.113.0/24"
],
"keyId": "ak_1a3c6de8153d5a5b04cd2a6529779542",
"label": "Trading Bot",
"lastUsedAt": "2025-01-01T00:00:00Z",
"policyId": "1",
"publicKeyEd25519": "AA==",
"purpose": "STANDARD",
"revision": "1",
"status": "ACTIVE",
"subaccountId": "6789012345678",
"updatedAt": "2025-01-01T00:00:00Z"
}
]
}auth.v1.SetAssistantKeysRequestauth.v1.SetAssistantKeysResponseThe complete set, at most one key per account and at most 64 keys. An account left out loses its assistant key.
Stable opaque identifier used to refer to this key, formatted as "ak_" followed by 32 lowercase hex characters.
Human-readable label for the key. Maximum length is 64 characters.
Optional user-chosen icon/emoji for UI display.
Optional user-chosen color token for UI display.
Optional CIDR whitelist. Empty means no IP restriction. Maximum 32 unique entries.
Current key status.
Optional sub-account this key is scoped to (opaque ID; empty = root-level). Public ID. ConnectRPC carries it as fixed64 (a decimal string in JSON).
Optional API policy attached to this key (opaque ID). Empty means no policy is attached and the key has no permissions. Public ID. ConnectRPC carries it as fixed64 (a decimal string in JSON).
Time in UTC when this key was created.
Approximate last time in UTC when this key authenticated a request, recorded at most about once a minute; it may lag recent use by a few minutes. Omitted when no use has been recorded.
Ed25519 public key bytes associated with this API key. The private key or seed is never returned by the API.
Optional expiry time in UTC. When set, the key cannot authenticate requests after this time, regardless of status.
Read-only actor label describing who created this key, such as a username or account label.
Time in UTC when this key's configuration was last changed. For the same key, later is fresher, equal is an idempotent replay, and earlier is stale. Equal timestamps with different configuration indicate an invariant failure. This is independent of last_used_at, which tracks authentication activity.
Monotonic resource revision used for conditional updates.
What the key is for. ASSISTANT keys are managed with SetAssistantKeys and are otherwise listed, updated and revoked like any key.
| Key | HTTP status | Connect code | Error | When |
|---|---|---|---|---|
| unauthenticated | 401 | unauthenticated | Unauthenticated | Authentication required. |
| permission-denied | 403 | permission_denied | Permission Denied | Permission denied. |
| invalid-argument | 400 | invalid_argument | Invalid Argument | Invalid argument. |
| not-found | 404 | not_found | Not Found | Not found. |
| unavailable | 503 | unavailable | Unavailable | Service unavailable. |