Validate an API key and resolve tenant
Internal endpoint used by runtime enforcement layer to validate keys and derive effective tenant.
VALIDATION CHECKS: 1. Key exists in database 2. Key hash matches 3. Status is ACTIVE (not REVOKED or EXPIRED) 4. Current time < expires_at 5. Tenant is ACTIVE (not SUSPENDED or CLOSED)
RESPONSE: - If valid: returns tenant_id, permissions, scope_filter - If invalid: returns valid=false with reason
CACHING: - Results should be cached with short TTL (60s) - Invalidate cache on key revocation
Authorizations
Administrative API key with full system access. Also accepted as an alternative to ApiKeyAuth on an explicit per-operation allowlist — the authoritative list is the union of operations whose security: block declares AdminKeyAuth (consult per-operation security blocks rather than this prose, which has historically drifted as the dual-auth surface expanded). When using AdminKeyAuth on list or fund endpoints, a tenant scoping parameter (typically tenant or tenant_id) is required for scoping (400 if missing) — the per-operation description specifies which. Lookup-style endpoints that uniquely identify a resource by non-tenant key (e.g. GET /v1/admin/budgets/lookup, where the (scope, unit) pair is unique) do NOT require a tenant parameter. Allowlisting is per-operation (exact method:path matching — no prefix matching, no wildcards) so new endpoints do not accidentally inherit admin-accessible status.
Request Body
Responses
Validation result