# bex-api's API-key surface (backend/internal/apikeys/graphql.go, docs/ADR012-auth.md).
# Keys are workspace-shared machine credentials (Hydra OAuth2 clients), not
# per-user — the list query never requests `secret` (the server always resolves
# it empty for `apiKeys` anyway, but the dashboard doesn't even ask): the only
# place a secret is ever fetched is the create mutation's response, exactly
# once, matching Render's "shown only at creation" API-key UX.

query ApiKeys {
  apiKeys {
    id
    name
    createdAt
    createdBy
    lastUsedAt
  }
}

mutation CreateApiKey($name: String!) {
  createApiKey(name: $name) {
    id
    name
    secret
    createdAt
  }
}

mutation RevokeApiKey($id: String!) {
  revokeApiKey(id: $id)
}
