From 2b7164c38b4ecc99faf594914a6e2c6b4b094afb Mon Sep 17 00:00:00 2001 From: "stainless-app[bot]" <142633134+stainless-app[bot]@users.noreply.github.com> Date: Fri, 12 Jun 2026 16:08:43 +0000 Subject: [PATCH 1/6] feat(api): surface deleted/expired API keys for audit trail (KERNEL-1350) --- .stats.yml | 4 ++-- api.md | 2 +- src/client.ts | 2 ++ src/resources/api-keys.ts | 36 ++++++++++++++++++++++++++-- src/resources/index.ts | 1 + tests/api-resources/api-keys.test.ts | 9 +++++++ 6 files changed, 49 insertions(+), 5 deletions(-) diff --git a/.stats.yml b/.stats.yml index a1640098..3ff52d98 100644 --- a/.stats.yml +++ b/.stats.yml @@ -1,4 +1,4 @@ configured_endpoints: 119 -openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel/kernel-51549f813f3002e18c6ca8d850cc0c7932828d511c151e0412c73b6798d19e30.yml -openapi_spec_hash: ee77b293c4bda91c1a32cfdd12b8739e +openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel/kernel-42074f2b600b0dc805377d6793e4bb30c959738b0f9cc44c409d094517e5e0ab.yml +openapi_spec_hash: 81c27a833d6d9637787634180dec2abd config_hash: 57567e00b41af47cef1b78e51b747aa0 diff --git a/api.md b/api.md index 79b92058..5c2fb0c5 100644 --- a/api.md +++ b/api.md @@ -399,7 +399,7 @@ Types: Methods: - client.apiKeys.create({ ...params }) -> CreatedAPIKey -- client.apiKeys.retrieve(id) -> APIKey +- client.apiKeys.retrieve(id, { ...params }) -> APIKey - client.apiKeys.update(id, { ...params }) -> APIKey - client.apiKeys.list({ ...params }) -> APIKeysOffsetPagination - client.apiKeys.delete(id) -> void diff --git a/src/client.ts b/src/client.ts index 8a94d125..cb1dd80d 100644 --- a/src/client.ts +++ b/src/client.ts @@ -23,6 +23,7 @@ import { APIKey, APIKeyCreateParams, APIKeyListParams, + APIKeyRetrieveParams, APIKeyUpdateParams, APIKeys, APIKeysOffsetPagination, @@ -1158,6 +1159,7 @@ export declare namespace Kernel { type CreatedAPIKey as CreatedAPIKey, type APIKeysOffsetPagination as APIKeysOffsetPagination, type APIKeyCreateParams as APIKeyCreateParams, + type APIKeyRetrieveParams as APIKeyRetrieveParams, type APIKeyUpdateParams as APIKeyUpdateParams, type APIKeyListParams as APIKeyListParams, }; diff --git a/src/resources/api-keys.ts b/src/resources/api-keys.ts index a855c962..49c172bb 100644 --- a/src/resources/api-keys.ts +++ b/src/resources/api-keys.ts @@ -34,8 +34,12 @@ export class APIKeys extends APIResource { * const apiKey = await client.apiKeys.retrieve('id'); * ``` */ - retrieve(id: string, options?: RequestOptions): APIPromise { - return this._client.get(path`/org/api_keys/${id}`, options); + retrieve( + id: string, + query: APIKeyRetrieveParams | null | undefined = {}, + options?: RequestOptions, + ): APIPromise { + return this._client.get(path`/org/api_keys/${id}`, { query, ...options }); } /** @@ -101,6 +105,12 @@ export interface APIKey { created_by: APIKey.CreatedBy; + /** + * When the API key was deleted (soft-deleted). Null for keys that have not been + * deleted. + */ + deleted_at: string | null; + /** * When the API key expires */ @@ -126,6 +136,13 @@ export interface APIKey { * project name is unavailable. */ project_name: string | null; + + /** + * Derived lifecycle status of the API key. `active` means usable. `expired` means + * past its expires_at. `deleted` means it was deleted (soft-deleted) and can no + * longer authenticate. Deleted takes precedence over expired. + */ + status: 'active' | 'expired' | 'deleted'; } export namespace APIKey { @@ -174,6 +191,14 @@ export interface APIKeyCreateParams { project_id?: string | null; } +export interface APIKeyRetrieveParams { + /** + * When true, return the API key even if it has been deleted (soft-deleted), for + * audit purposes. Defaults to false, which returns 404 for a deleted key. + */ + include_deleted?: boolean; +} + export interface APIKeyUpdateParams { /** * New API key name @@ -182,6 +207,12 @@ export interface APIKeyUpdateParams { } export interface APIKeyListParams extends OffsetPaginationParams { + /** + * When true, include deleted (soft-deleted) API keys in the results for audit + * purposes. Defaults to false, which returns only live keys. + */ + include_deleted?: boolean; + /** * Case-insensitive substring match against API key name, creator, and project. API * key identifiers and masked keys match by exact value or prefix. @@ -205,6 +236,7 @@ export declare namespace APIKeys { type CreatedAPIKey as CreatedAPIKey, type APIKeysOffsetPagination as APIKeysOffsetPagination, type APIKeyCreateParams as APIKeyCreateParams, + type APIKeyRetrieveParams as APIKeyRetrieveParams, type APIKeyUpdateParams as APIKeyUpdateParams, type APIKeyListParams as APIKeyListParams, }; diff --git a/src/resources/index.ts b/src/resources/index.ts index 491319db..b73f26f3 100644 --- a/src/resources/index.ts +++ b/src/resources/index.ts @@ -6,6 +6,7 @@ export { type APIKey, type CreatedAPIKey, type APIKeyCreateParams, + type APIKeyRetrieveParams, type APIKeyUpdateParams, type APIKeyListParams, type APIKeysOffsetPagination, diff --git a/tests/api-resources/api-keys.test.ts b/tests/api-resources/api-keys.test.ts index 14a45a0d..1dbeb3e7 100644 --- a/tests/api-resources/api-keys.test.ts +++ b/tests/api-resources/api-keys.test.ts @@ -41,6 +41,14 @@ describe('resource apiKeys', () => { expect(dataAndResponse.response).toBe(rawResponse); }); + // Mock server tests are disabled + test.skip('retrieve: request options and params are passed correctly', async () => { + // ensure the request options are being passed correctly by passing an invalid HTTP method in order to cause an error + await expect( + client.apiKeys.retrieve('id', { include_deleted: true }, { path: '/_stainless_unknown_path' }), + ).rejects.toThrow(Kernel.NotFoundError); + }); + // Mock server tests are disabled test.skip('update: only required params', async () => { const responsePromise = client.apiKeys.update('id', { name: 'new-api-name' }); @@ -76,6 +84,7 @@ describe('resource apiKeys', () => { await expect( client.apiKeys.list( { + include_deleted: true, limit: 100, offset: 0, query: 'query', From 1927f1d8c993546d55a3e53a4c976cf5b8a84907 Mon Sep 17 00:00:00 2001 From: "stainless-app[bot]" <142633134+stainless-app[bot]@users.noreply.github.com> Date: Fri, 12 Jun 2026 19:04:31 +0000 Subject: [PATCH 2/6] codegen metadata --- .stats.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.stats.yml b/.stats.yml index 3ff52d98..ab902c2f 100644 --- a/.stats.yml +++ b/.stats.yml @@ -1,4 +1,4 @@ configured_endpoints: 119 -openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel/kernel-42074f2b600b0dc805377d6793e4bb30c959738b0f9cc44c409d094517e5e0ab.yml -openapi_spec_hash: 81c27a833d6d9637787634180dec2abd +openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel/kernel-c98841235b0ece0591f28f7dd424339b6ef2f3e8f539b95b670ae0da2ef43df4.yml +openapi_spec_hash: c1e9456765f0743a333af297d135d5cf config_hash: 57567e00b41af47cef1b78e51b747aa0 From c0d9f9023e79159def22465bb2249fdbd689cd98 Mon Sep 17 00:00:00 2001 From: "stainless-app[bot]" <142633134+stainless-app[bot]@users.noreply.github.com> Date: Sun, 14 Jun 2026 19:09:00 +0000 Subject: [PATCH 3/6] feat: Add API key rotate endpoint --- .stats.yml | 8 +++---- api.md | 1 + src/client.ts | 2 ++ src/resources/api-keys.ts | 33 ++++++++++++++++++++++++++++ src/resources/index.ts | 1 + tests/api-resources/api-keys.test.ts | 24 ++++++++++++++++++++ 6 files changed, 65 insertions(+), 4 deletions(-) diff --git a/.stats.yml b/.stats.yml index ab902c2f..8d8fe88a 100644 --- a/.stats.yml +++ b/.stats.yml @@ -1,4 +1,4 @@ -configured_endpoints: 119 -openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel/kernel-c98841235b0ece0591f28f7dd424339b6ef2f3e8f539b95b670ae0da2ef43df4.yml -openapi_spec_hash: c1e9456765f0743a333af297d135d5cf -config_hash: 57567e00b41af47cef1b78e51b747aa0 +configured_endpoints: 120 +openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel/kernel-1f10598afa01d76d22b0ed63685248f482f74c9353cffe1d3e4a3d38da7716cf.yml +openapi_spec_hash: 8936f458bfa681b709e459ca1cc76fb5 +config_hash: 03c7e57f268c750e2415831662e95969 diff --git a/api.md b/api.md index 5c2fb0c5..7a48707d 100644 --- a/api.md +++ b/api.md @@ -403,6 +403,7 @@ Methods: - client.apiKeys.update(id, { ...params }) -> APIKey - client.apiKeys.list({ ...params }) -> APIKeysOffsetPagination - client.apiKeys.delete(id) -> void +- client.apiKeys.rotate(id, { ...params }) -> CreatedAPIKey # CredentialProviders diff --git a/src/client.ts b/src/client.ts index cb1dd80d..53d9a64b 100644 --- a/src/client.ts +++ b/src/client.ts @@ -24,6 +24,7 @@ import { APIKeyCreateParams, APIKeyListParams, APIKeyRetrieveParams, + APIKeyRotateParams, APIKeyUpdateParams, APIKeys, APIKeysOffsetPagination, @@ -1162,6 +1163,7 @@ export declare namespace Kernel { type APIKeyRetrieveParams as APIKeyRetrieveParams, type APIKeyUpdateParams as APIKeyUpdateParams, type APIKeyListParams as APIKeyListParams, + type APIKeyRotateParams as APIKeyRotateParams, }; export { diff --git a/src/resources/api-keys.ts b/src/resources/api-keys.ts index 49c172bb..7dc62e6d 100644 --- a/src/resources/api-keys.ts +++ b/src/resources/api-keys.ts @@ -88,6 +88,24 @@ export class APIKeys extends APIResource { headers: buildHeaders([{ Accept: '*/*' }, options?.headers]), }); } + + /** + * Rotate an API key. Issues a new key that copies the name and project of the + * rotated key, and schedules the rotated key to expire after a grace period so + * in-flight callers can swap over. The new plaintext key is returned once. + * + * @example + * ```ts + * const createdAPIKey = await client.apiKeys.rotate('id'); + * ``` + */ + rotate( + id: string, + body: APIKeyRotateParams | null | undefined = {}, + options?: RequestOptions, + ): APIPromise { + return this._client.post(path`/org/api_keys/${id}/rotate`, { body, ...options }); + } } export type APIKeysOffsetPagination = OffsetPagination; @@ -230,6 +248,20 @@ export interface APIKeyListParams extends OffsetPaginationParams { sort_direction?: 'asc' | 'desc'; } +export interface APIKeyRotateParams { + /** + * Lifetime in days for the new key, up to 3650. Omit to reuse the rotated key's + * original lifetime, or never-expires if it had none. + */ + days_to_expire?: number | null; + + /** + * Grace period in days before the rotated key expires. Use 0 to expire it + * immediately. Omit for the default grace period of 7 days. + */ + expire_in_days?: number | null; +} + export declare namespace APIKeys { export { type APIKey as APIKey, @@ -239,5 +271,6 @@ export declare namespace APIKeys { type APIKeyRetrieveParams as APIKeyRetrieveParams, type APIKeyUpdateParams as APIKeyUpdateParams, type APIKeyListParams as APIKeyListParams, + type APIKeyRotateParams as APIKeyRotateParams, }; } diff --git a/src/resources/index.ts b/src/resources/index.ts index b73f26f3..bc3f9ffa 100644 --- a/src/resources/index.ts +++ b/src/resources/index.ts @@ -9,6 +9,7 @@ export { type APIKeyRetrieveParams, type APIKeyUpdateParams, type APIKeyListParams, + type APIKeyRotateParams, type APIKeysOffsetPagination, } from './api-keys'; export { diff --git a/tests/api-resources/api-keys.test.ts b/tests/api-resources/api-keys.test.ts index 1dbeb3e7..3c1497bb 100644 --- a/tests/api-resources/api-keys.test.ts +++ b/tests/api-resources/api-keys.test.ts @@ -107,4 +107,28 @@ describe('resource apiKeys', () => { expect(dataAndResponse.data).toBe(response); expect(dataAndResponse.response).toBe(rawResponse); }); + + // Mock server tests are disabled + test.skip('rotate', async () => { + const responsePromise = client.apiKeys.rotate('id'); + const rawResponse = await responsePromise.asResponse(); + expect(rawResponse).toBeInstanceOf(Response); + const response = await responsePromise; + expect(response).not.toBeInstanceOf(Response); + const dataAndResponse = await responsePromise.withResponse(); + expect(dataAndResponse.data).toBe(response); + expect(dataAndResponse.response).toBe(rawResponse); + }); + + // Mock server tests are disabled + test.skip('rotate: request options and params are passed correctly', async () => { + // ensure the request options are being passed correctly by passing an invalid HTTP method in order to cause an error + await expect( + client.apiKeys.rotate( + 'id', + { days_to_expire: 30, expire_in_days: 7 }, + { path: '/_stainless_unknown_path' }, + ), + ).rejects.toThrow(Kernel.NotFoundError); + }); }); From faf4119ff60ad8805c20e01f05ea59684dc91205 Mon Sep 17 00:00:00 2001 From: "stainless-app[bot]" <142633134+stainless-app[bot]@users.noreply.github.com> Date: Sun, 14 Jun 2026 20:21:25 +0000 Subject: [PATCH 4/6] refactor(api): align API key audit surface with browser sibling (KERNEL-1350) --- .stats.yml | 4 ++-- src/resources/api-keys.ts | 18 +++++++++--------- tests/api-resources/api-keys.test.ts | 1 + 3 files changed, 12 insertions(+), 11 deletions(-) diff --git a/.stats.yml b/.stats.yml index 8d8fe88a..4127b5f2 100644 --- a/.stats.yml +++ b/.stats.yml @@ -1,4 +1,4 @@ configured_endpoints: 120 -openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel/kernel-1f10598afa01d76d22b0ed63685248f482f74c9353cffe1d3e4a3d38da7716cf.yml -openapi_spec_hash: 8936f458bfa681b709e459ca1cc76fb5 +openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel/kernel-e8afdbeac9332cf79200c2eb873e532104fd0a7472b08e63cde6c857a87cf0c3.yml +openapi_spec_hash: 2525caf30dffbdd83c83948201f11a52 config_hash: 03c7e57f268c750e2415831662e95969 diff --git a/src/resources/api-keys.ts b/src/resources/api-keys.ts index 7dc62e6d..60b41f54 100644 --- a/src/resources/api-keys.ts +++ b/src/resources/api-keys.ts @@ -154,13 +154,6 @@ export interface APIKey { * project name is unavailable. */ project_name: string | null; - - /** - * Derived lifecycle status of the API key. `active` means usable. `expired` means - * past its expires_at. `deleted` means it was deleted (soft-deleted) and can no - * longer authenticate. Deleted takes precedence over expired. - */ - status: 'active' | 'expired' | 'deleted'; } export namespace APIKey { @@ -226,8 +219,8 @@ export interface APIKeyUpdateParams { export interface APIKeyListParams extends OffsetPaginationParams { /** - * When true, include deleted (soft-deleted) API keys in the results for audit - * purposes. Defaults to false, which returns only live keys. + * Deprecated: use status=all instead. When true, include deleted (soft-deleted) + * API keys in the results for audit purposes. */ include_deleted?: boolean; @@ -246,6 +239,13 @@ export interface APIKeyListParams extends OffsetPaginationParams { * Sort direction for API keys. */ sort_direction?: 'asc' | 'desc'; + + /** + * Filter API keys by status. "active" returns keys that are not deleted (default; + * expired-but-not-deleted keys are still included), "deleted" returns only + * soft-deleted keys, "all" returns both. + */ + status?: 'active' | 'deleted' | 'all'; } export interface APIKeyRotateParams { diff --git a/tests/api-resources/api-keys.test.ts b/tests/api-resources/api-keys.test.ts index 3c1497bb..b179ccfb 100644 --- a/tests/api-resources/api-keys.test.ts +++ b/tests/api-resources/api-keys.test.ts @@ -90,6 +90,7 @@ describe('resource apiKeys', () => { query: 'query', sort_by: 'created_at', sort_direction: 'asc', + status: 'active', }, { path: '/_stainless_unknown_path' }, ), From 44ebf0e80f341467c9b1380ac9031b9e0ff555ed Mon Sep 17 00:00:00 2001 From: "stainless-app[bot]" <142633134+stainless-app[bot]@users.noreply.github.com> Date: Mon, 15 Jun 2026 18:41:40 +0000 Subject: [PATCH 5/6] codegen metadata --- .stats.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.stats.yml b/.stats.yml index 4127b5f2..29192087 100644 --- a/.stats.yml +++ b/.stats.yml @@ -1,4 +1,4 @@ configured_endpoints: 120 -openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel/kernel-e8afdbeac9332cf79200c2eb873e532104fd0a7472b08e63cde6c857a87cf0c3.yml -openapi_spec_hash: 2525caf30dffbdd83c83948201f11a52 +openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel/kernel-d26459bd3514237e8d757be3cbdc76ca62f6083504b85601e57db830888964f7.yml +openapi_spec_hash: 5dd151a8099398819a97692c1c60c3c6 config_hash: 03c7e57f268c750e2415831662e95969 From d1cf3dccbc613eb9cab16709936be8982ea7a321 Mon Sep 17 00:00:00 2001 From: "stainless-app[bot]" <142633134+stainless-app[bot]@users.noreply.github.com> Date: Mon, 15 Jun 2026 18:42:06 +0000 Subject: [PATCH 6/6] release: 0.68.0 --- .release-please-manifest.json | 2 +- CHANGELOG.md | 26 ++++++++++++++++++++++++++ package.json | 2 +- src/version.ts | 2 +- 4 files changed, 29 insertions(+), 3 deletions(-) diff --git a/.release-please-manifest.json b/.release-please-manifest.json index 94994d4f..e5a17c22 100644 --- a/.release-please-manifest.json +++ b/.release-please-manifest.json @@ -1,3 +1,3 @@ { - ".": "0.67.0" + ".": "0.68.0" } diff --git a/CHANGELOG.md b/CHANGELOG.md index cd0a6963..5ef0b92b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,31 @@ # Changelog +## 0.68.0 (2026-06-15) + +Full Changelog: [v0.67.0...v0.68.0](https://github.com/kernel/kernel-node-sdk/compare/v0.67.0...v0.68.0) + +### Features + +* Add API key rotate endpoint ([c0d9f90](https://github.com/kernel/kernel-node-sdk/commit/c0d9f9023e79159def22465bb2249fdbd689cd98)) +* **api:** surface deleted/expired API keys for audit trail (KERNEL-1350) ([2b7164c](https://github.com/kernel/kernel-node-sdk/commit/2b7164c38b4ecc99faf594914a6e2c6b4b094afb)) + + +### Bug Fixes + +* **pagination:** fail loudly when X-Has-More contradicts a missing X-Next-Offset ([994749d](https://github.com/kernel/kernel-node-sdk/commit/994749dd56176dfae27a60d9b8df6bf10c335eb8)) +* **pagination:** stop on the X-Next-Offset 0 sentinel, not just has_more ([d318410](https://github.com/kernel/kernel-node-sdk/commit/d3184109680279c5c6565f730c874ae04c52a58d)) +* **pagination:** stop skipping a page per auto-pagination iteration ([f7bf2d9](https://github.com/kernel/kernel-node-sdk/commit/f7bf2d92d25c85be6b0b33d6ce738f75917dceff)) + + +### Styles + +* prettier-format pagination test ([16ee899](https://github.com/kernel/kernel-node-sdk/commit/16ee899f00f755d72db94fe7cd37c1af1770d51f)) + + +### Refactors + +* **api:** align API key audit surface with browser sibling (KERNEL-1350) ([faf4119](https://github.com/kernel/kernel-node-sdk/commit/faf4119ff60ad8805c20e01f05ea59684dc91205)) + ## 0.67.0 (2026-06-11) Full Changelog: [v0.66.0...v0.67.0](https://github.com/kernel/kernel-node-sdk/compare/v0.66.0...v0.67.0) diff --git a/package.json b/package.json index e2856f29..6e3d5cd4 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@onkernel/sdk", - "version": "0.67.0", + "version": "0.68.0", "description": "The official TypeScript library for the Kernel API", "author": "Kernel <>", "types": "dist/index.d.ts", diff --git a/src/version.ts b/src/version.ts index ed32717a..71e73403 100644 --- a/src/version.ts +++ b/src/version.ts @@ -1 +1 @@ -export const VERSION = '0.67.0'; // x-release-please-version +export const VERSION = '0.68.0'; // x-release-please-version