Revoked API key

A key revoked by the agent (or by AirIQ) answers 401 at generate-token at once.

▸1. Generate tokenPOST /generate-tokenfailed 401

What this step returned(click to expand)

Request body

{
  "api_key": "<redacted>"
}

Reply (failed, HTTP 401)

{
  "code": 9001,
  "message": "Authentication required",
  "detail": "Invalid API key",
  "traceId": "6c3be70b6e70e9a2f3dd37c476c76ae0"
}

Keys and what they mean

Request

key	type	when present	importance	meaning
api_key	string	required	must read	Your API key (starts with aiqo_). Keep it on your server; never send it from a browser or app.
Total: 1 keys

key	type	when present	importance	meaning
token	string	always	must read	Send it as Authorization: Bearer <token> on every other call.
token_type	string	always	informational	Always Bearer.
expires_in	integer	always	must read	Seconds the token lives (14400 = 4 hours). Get a new token before it ends; a call with an expired token answers 401.
expires_at	datetime	always	useful	The same end as a time (UTC).
Total: 4 keys

Errors this call answers with (4)

HTTP	code	message	detail	when
401	9001	Authentication required	Invalid api_key	Unknown key, suspended user, or the API has no API-key routes (today). Observed on the local stack.
401	9001	Authentication required	Api_key required
400	5000	Invalid request	(Huma's text)	Malformed JSON or wrong content type.
429	9004	Too many requests		Rate limit, when configured.

Questions developers ask (2)

How long does a token last?: 4 hours (expires_in, expires_at). Renew before it ends; an expired token answers 401 with code 9001.
Can I call the API from a browser or a mobile app?: No. The API key must stay on your server; call the API from there.