nexalwarenexalwaredocs
API ReferenceApi keys

List everything a key has been granted

Dashboard-only

This mirrors what a human does from the Nexalware web app - it's not meant to be automated by a third-party integration, even though a session token from Log in can technically call it. If you're building an integration that controls devices, use an API key instead: have an Owner/Admin grant it access to a device (a DeviceGrant), and use the Device Control endpoints.
GET
/api/v1/keys/{keyId}/grants

Every DeviceGrant scoping this key to a device or project, across your whole account - the reverse view of a device's own Permissions tab, for seeing (and eventually managing) a single key's whole reach in one place.

Authorization

sessionAuth
AuthorizationBearer <token>

A session token for an existing account, obtained from POST /auth/login (see the Authentication endpoints) - not an API key. Endpoints marked with this scheme reject API key callers outright, regardless of what that key is granted. Outside the Authentication endpoints themselves, everything requiring this scheme manages dashboard resources (rules, grants, keys, device configuration, command catalogs) and mirrors what a human does in the Nexalware web app - it is not meant to be automated by a third-party integration the way the Device Control and Schedules endpoints are.

In: header

Path Parameters

keyId*string

Response Body

application/json

application/json

curl -X GET "https://example.com/api/v1/keys/key_x1y2z3/grants"
[  {    "grantId": "string",    "appliesVia": "device",    "device": {      "deviceId": "string",      "name": "string"    },    "project": {      "projectId": "string",      "name": "string"    },    "commands": [      "string"    ],    "scope": "READ",    "expiresAt": "2019-08-24T14:15:22Z",    "rateLimitPerMinute": 0,    "createdAt": "2019-08-24T14:15:22Z"  }]

Create an API key POST

The raw key is returned once, at creation only, and cannot be recovered afterward. A new key can call nothing until a DeviceGrant is created for it (see the Grants endpoints). **Next step:** copy the `key` value from the response (starts with `nxw_live_sk_`), then call POST /devices/{deviceId}/grants with this key's `keyId` to actually let it do something.

List your account's API keys GET

Never includes the raw secret, only `prefix` (e.g. `nxw_live_sk_ab12`) to help you tell keys apart, the full value is shown exactly once, at creation.