Management API — Red Team API Keys

Manage the folder-scoped Red Team API Keys used with the SDK. All endpoints require a Management API Key and are scoped to its organization — see the Overview for authentication and error conventions.

Keys created here are folder-scoped: a key can only access the targets, scans, and evaluations in its folder. The Management API cannot create another Management API Key — that lifecycle is dashboard-only.

The secret is returned only once, when the key is created or rotated. It is never stored in plaintext and cannot be retrieved afterward, so record it at creation time.

List keys

GET /management/folders/{folderId}/keys

Returns metadata for each key in the folder. The secret is never included in a listing.

$
curl -H "Authorization: Bearer $LAKERA_MANAGEMENT_KEY" \
>
  https://$LAKERA_RED_HOST/management/folders/{folderId}/keys

1
{
2
  "keys": [
3
    {
4
      "id": "...",
5
      "folderId": "...",
6
      "name": "CI key",
7
      "prefix": "sk_lr_...",
8
      "createdAt": 1786546819835,
9
      "revokedAt": 1786550000000,
10
      "lastUsedAt": 1786549000000
11
    }
12
  ]
13
}

revokedAt and lastUsedAt are present only when applicable.

Create a key

POST /management/folders/{folderId}/keys

$
curl -X POST -H "Authorization: Bearer $LAKERA_MANAGEMENT_KEY" \
>
  -H "Content-Type: application/json" \
>
  -d '{"name": "CI key"}' \
>
  https://$LAKERA_RED_HOST/management/folders/{folderId}/keys

Responds 201 with the key id and the secret:

1
{ "keyId": "...", "key": "sk_lr_..." }

Rotate a key

POST /management/folders/{folderId}/keys/{keyId}/rotate

Issues a replacement key with the same name and immediately revokes the old one, so the two are never valid at the same time.

$
curl -X POST -H "Authorization: Bearer $LAKERA_MANAGEMENT_KEY" \
>
  https://$LAKERA_RED_HOST/management/folders/{folderId}/keys/{keyId}/rotate

Responds with the new key id and secret:

1
{ "keyId": "...", "key": "sk_lr_..." }

Revoke a key

DELETE /management/folders/{folderId}/keys/{keyId}

$
curl -X DELETE -H "Authorization: Bearer $LAKERA_MANAGEMENT_KEY" \
>
  https://$LAKERA_RED_HOST/management/folders/{folderId}/keys/{keyId}

Responds 204. Revoking an already-revoked key is a no-op.