67:I[357622,["$5","$6","$7","$8","$9","$a","$b","$c","$d","$e","$f","$10","$11","$32","$33","$34","$35","$36","$44","$45"],"CopyButton"] 6a:I[522016,["$5","$6","$7","$8","$9","$a","$b","$c","$d","$e","$f","$10","$11","$32","$33","$34","$35","$36","$44","$45"],""] 4d:["$","div","fc8a5a5ac517",{"className":"my-4 sm:my-6 overflow-x-auto","children":["$","table",null,{"className":"w-full text-sm border-collapse","children":[["$","thead",null,{"children":["$","tr",null,{"className":"border-b border-hairline","children":[["$","th","1",{"className":"text-left px-4 py-3 font-semibold text-default","children":[["$","$1","t0-0",{"children":"Level"}]]}],["$","th","9",{"className":"text-left px-4 py-3 font-semibold text-default","children":[["$","$1","t0-0",{"children":"Queries"}]]}],["$","th","19",{"className":"text-left px-4 py-3 font-semibold text-default","children":[["$","$1","t0-0",{"children":"Mutations"}]]}],["$","th","31",{"className":"text-left px-4 py-3 font-semibold text-default","children":[["$","$1","t0-0",{"children":"Notes"}]]}]]}]}],["$","tbody",null,{"children":[["$","tr","80",{"className":"border-b border-hairline","children":[["$","td","81",{"className":"px-4 py-3 text-default align-top","children":[["$","code","t0-0",{"className":"px-1.5 py-0.5 rounded text-[0.85em] font-mono bg-inset text-default border border-default","children":"read"}]]}],["$","td","90",{"className":"px-4 py-3 text-default align-top","children":[["$","$1","t0-0",{"children":"All readable fields"}]]}],["$","td","112",{"className":"px-4 py-3 text-default align-top","children":[["$","$1","t0-0",{"children":"None"}]]}],["$","td","119",{"className":"px-4 py-3 text-default align-top","children":[["$","$1","t0-0",{"children":"Read-only access to everything the user can see"}]]}]]}],["$","tr","170",{"className":"border-b border-hairline","children":[["$","td","171",{"className":"px-4 py-3 text-default align-top","children":[["$","code","t0-0",{"className":"px-1.5 py-0.5 rounded text-[0.85em] font-mono bg-inset text-default border border-default","children":"write"}]]}],["$","td","181",{"className":"px-4 py-3 text-default align-top","children":[["$","$1","t0-0",{"children":"All readable fields"}]]}],["$","td","203",{"className":"px-4 py-3 text-default align-top","children":[["$","$1","t0-0",{"children":"All writable fields"}]]}],["$","td","225",{"className":"px-4 py-3 text-default align-top","children":[["$","$1","t0-0",{"children":"Full read and write access"}]]}]]}],["$","tr","255",{"className":"border-b border-hairline","children":[["$","td","256",{"className":"px-4 py-3 text-default align-top","children":[["$","code","t0-0",{"className":"px-1.5 py-0.5 rounded text-[0.85em] font-mono bg-inset text-default border border-default","children":"full"}]]}],["$","td","265",{"className":"px-4 py-3 text-default align-top","children":[["$","$1","t0-0",{"children":"All readable fields"}]]}],["$","td","287",{"className":"px-4 py-3 text-default align-top","children":[["$","$1","t0-0",{"children":"All writable fields"}]]}],["$","td","309",{"className":"px-4 py-3 text-default align-top","children":[["$","$1","t0-0",{"children":"Same as "}],["$","code","t0-8",{"className":"px-1.5 py-0.5 rounded text-[0.85em] font-mono bg-inset text-default border border-default","children":"write"}],["$","$1","t0-15",{"children":", plus administrative operations"}]]}]]}],["$","tr","360",{"className":"border-b border-hairline","children":[["$","td","361",{"className":"px-4 py-3 text-default align-top","children":[["$","code","t0-0",{"className":"px-1.5 py-0.5 rounded text-[0.85em] font-mono bg-inset text-default border border-default","children":"admin"}]]}],["$","td","371",{"className":"px-4 py-3 text-default align-top","children":[["$","$1","t0-0",{"children":"All readable fields"}]]}],["$","td","393",{"className":"px-4 py-3 text-default align-top","children":[["$","$1","t0-0",{"children":"All writable fields"}]]}],["$","td","415",{"className":"px-4 py-3 text-default align-top","children":[["$","$1","t0-0",{"children":"Same as "}],["$","code","t0-8",{"className":"px-1.5 py-0.5 rounded text-[0.85em] font-mono bg-inset text-default border border-default","children":"full"}],["$","$1","t0-14",{"children":" — requires admin role to create"}]]}]]}]]}]]}]}] 4e:["$","p","e980b06b9471",{"className":"mb-4 leading-relaxed text-sm sm:text-base text-secondary","children":["The permission level applies uniformly. A ",["$","code","32e86c815bd9",{"className":"px-1.5 py-0.5 rounded text-[0.85em] font-mono bg-inset text-default border border-default","children":["read"]}]," key can query issues, threads, documents, and all other resources — but cannot create or update anything. A ",["$","code","43837857102d",{"className":"px-1.5 py-0.5 rounded text-[0.85em] font-mono bg-inset text-default border border-default","children":["write"]}]," key can do both."]}] 4f:["$","div","a6556ab2acf3",{"className":"my-4 sm:my-6","children":["$","div",null,{"className":"relative","children":["$","div",null,{"className":"rounded-lg p-4 sm:p-6 border-l-4 bg-inset border-primary","children":["$","div",null,{"className":"text-xs sm:text-sm leading-relaxed text-default","children":[["$","strong","f406c0a91cda",{"children":["Note:"]}]," The ",["$","code","94a970e82035",{"className":"px-1.5 py-0.5 rounded text-[0.85em] font-mono bg-inset text-default border border-default","children":["admin"]}]," permission level requires the creating user to have an admin role in the workspace. It provides the same access as ",["$","code","5f8227dc19c7",{"className":"px-1.5 py-0.5 rounded text-[0.85em] font-mono bg-inset text-default border border-default","children":["full"]}]," but signals intent for administrative use."]}]}]}]}] 50:["$","$L4c","3a51d852dbdc",{"id":"using-a-personal-api-key","as":"h2","className":"text-xl sm:text-2xl font-semibold mt-10 border-t border-hairline pt-10 mb-4 scroll-mt-20 text-default first:mt-0 first:border-t-0 first:pt-0","children":["Using a personal API key"]}] 51:["$","p","de934c2bc669",{"className":"mb-4 leading-relaxed text-sm sm:text-base text-secondary","children":["Pass your key in the ",["$","code","2c5e0a90daf8",{"className":"px-1.5 py-0.5 rounded text-[0.85em] font-mono bg-inset text-default border border-default","children":["X-API-Key"]}]," header:"]}] 68:T558,

curl \
  -X POST \
  -H "Content-Type: application/json" \
  -H "X-API-Key: sand_personal_abc123..." \
  --data '{ "query": "{ me { id fullName email } }" }' \
  https://api.sandstone.ai/graphql

52:["$","div","8b4a8ead0535",{"className":"my-4 sm:my-6 relative group/code rounded-lg bg-inset overflow-hidden","data-code-block":true,"children":[["$","div",null,{"className":"absolute top-2 right-2 z-10 opacity-0 [@media(hover:none)]:opacity-100 pointer-coarse:opacity-100 group-hover/code:opacity-100 group-focus-within/code:opacity-100 transition-opacity","children":["$","$L67",null,{"text":"curl \\\n -X POST \\\n -H \"Content-Type: application/json\" \\\n -H \"X-API-Key: sand_personal_abc123...\" \\\n --data '{ \"query\": \"{ me { id fullName email } }\" }' \\\n https://api.sandstone.ai/graphql"}]}],["$","div",null,{"className":"[&_pre]:!m-0 [&_pre]:!bg-transparent [&_pre]:px-4 [&_pre]:py-3 [&_pre]:sm:px-5 [&_pre]:sm:py-4 [&_pre]:overflow-x-auto [&_pre]:text-[13px] [&_pre]:leading-relaxed [&_code]:!bg-transparent","dangerouslySetInnerHTML":{"__html":"$68"}}]]}] 53:["$","p","933393646396",{"className":"mb-4 leading-relaxed text-sm sm:text-base text-secondary","children":["The ",["$","code","6a170b6fa895",{"className":"px-1.5 py-0.5 rounded text-[0.85em] font-mono bg-inset text-default border border-default","children":["me"]}]," query returns the user who owns the key — personal keys always act as that user."]}] 54:["$","p","e95dcd2b7a6f",{"className":"mb-4 leading-relaxed text-sm sm:text-base text-secondary","children":["With the ",["$","a","23d6c45d6b13-9",{"href":"/developers/sdks/typescript-sdk","className":"font-medium hover:underline transition-colors wrap-break-word text-primary","target":"$undefined","rel":"$undefined","children":[["Sandstone SDK"],false]}],":"]}] 69:Tb31,

import { SandstoneClient } from "@sandstone/api-sdk";

const client = new SandstoneClient({
  apiKey: "sand_personal_abc123...",
});

// Returns the key owner's profile
const me = await client.me();
console.log(me.fullName, me.email);

// Queries run as the key owner — results are filtered by their access
const issues = await client.issues({ first: 20 });

55:["$","div","f95d8dba1fbe",{"className":"my-4 sm:my-6 relative group/code rounded-lg bg-inset overflow-hidden","data-code-block":true,"children":[["$","div",null,{"className":"absolute top-2 right-2 z-10 opacity-0 [@media(hover:none)]:opacity-100 pointer-coarse:opacity-100 group-hover/code:opacity-100 group-focus-within/code:opacity-100 transition-opacity","children":["$","$L67",null,{"text":"import { SandstoneClient } from \"@sandstone/api-sdk\";\n\nconst client = new SandstoneClient({\n apiKey: \"sand_personal_abc123...\",\n});\n\n// Returns the key owner's profile\nconst me = await client.me();\nconsole.log(me.fullName, me.email);\n\n// Queries run as the key owner — results are filtered by their access\nconst issues = await client.issues({ first: 20 });"}]}],["$","div",null,{"className":"[&_pre]:!m-0 [&_pre]:!bg-transparent [&_pre]:px-4 [&_pre]:py-3 [&_pre]:sm:px-5 [&_pre]:sm:py-4 [&_pre]:overflow-x-auto [&_pre]:text-[13px] [&_pre]:leading-relaxed [&_code]:!bg-transparent","dangerouslySetInnerHTML":{"__html":"$69"}}]]}] 56:["$","$L4c","bbe5fd15b4dd",{"id":"team-access","as":"h2","className":"text-xl sm:text-2xl font-semibold mt-10 border-t border-hairline pt-10 mb-4 scroll-mt-20 text-default first:mt-0 first:border-t-0 first:pt-0","children":["Team access"]}] 57:["$","p","a15f9e45cc4f",{"className":"mb-4 leading-relaxed text-sm sm:text-base text-secondary","children":["When creating a personal key, you can restrict it to specific teams. The key can only access data belonging to those teams. If no team restriction is set, the key inherits the user's full team membership."]}] 58:["$","div","5373e53de5b6",{"className":"my-4 sm:my-6 relative group/code rounded-lg bg-inset overflow-hidden","data-code-block":true,"children":[["$","div",null,{"className":"absolute top-2 right-2 z-10 opacity-0 [@media(hover:none)]:opacity-100 pointer-coarse:opacity-100 group-hover/code:opacity-100 group-focus-within/code:opacity-100 transition-opacity","children":["$","$L67",null,{"text":"# This query only returns teams the key has access to\nquery {\n teams {\n id\n name\n }\n}"}]}],["$","div",null,{"className":"[&_pre]:!m-0 [&_pre]:!bg-transparent [&_pre]:px-4 [&_pre]:py-3 [&_pre]:sm:px-5 [&_pre]:sm:py-4 [&_pre]:overflow-x-auto [&_pre]:text-[13px] [&_pre]:leading-relaxed [&_code]:!bg-transparent","dangerouslySetInnerHTML":{"__html":"

# This query only returns teams the key has access to\nquery {\n  teams {\n    id\n    name\n  }\n}

"}}]]}] 59:["$","$L4c","c15ba922c3a4",{"id":"key-management","as":"h2","className":"text-xl sm:text-2xl font-semibold mt-10 border-t border-hairline pt-10 mb-4 scroll-mt-20 text-default first:mt-0 first:border-t-0 first:pt-0","children":["Key management"]}] 5a:["$","$L4c","a043b90f29a2",{"id":"rotating-a-key","as":"h3","className":"text-lg sm:text-xl font-semibold mt-5 sm:mt-6 mb-3 scroll-mt-20 text-default","children":["Rotating a key"]}] 5b:["$","p","5314b8d94e93",{"className":"mb-4 leading-relaxed text-sm sm:text-base text-secondary","children":["Rotation generates a new key value while preserving the same key record, label, permissions, and team access. The old key is immediately invalidated."]}] 5c:["$","p","198f904fa203",{"className":"mb-4 leading-relaxed text-sm sm:text-base text-secondary","children":["Use rotation when you suspect a key may have been compromised, or as part of a regular rotation schedule. It's safer than revoking and recreating because downstream systems only need to update the key value — not reconfigure permissions."]}] 5d:["$","$L4c","172d6d0ce294",{"id":"revoking-a-key","as":"h3","className":"text-lg sm:text-xl font-semibold mt-5 sm:mt-6 mb-3 scroll-mt-20 text-default","children":["Revoking a key"]}] 5e:["$","p","f817ad7fa503",{"className":"mb-4 leading-relaxed text-sm sm:text-base text-secondary","children":["Revocation permanently disables the key. Revoked keys cannot be reactivated. All requests using a revoked key return `KEY_REVOKED: API key is not valid`."]}] 5f:["$","p","360807108c93",{"className":"mb-4 leading-relaxed text-sm sm:text-base text-secondary","children":["You can revoke your own personal keys. Workspace admins can revoke any personal key in the workspace."]}] 60:["$","$L4c","73e8092eb904",{"id":"error-handling","as":"h2","className":"text-xl sm:text-2xl font-semibold mt-10 border-t border-hairline pt-10 mb-4 scroll-mt-20 text-default first:mt-0 first:border-t-0 first:pt-0","children":["Error handling"]}] 61:["$","div","07718408965d",{"className":"my-4 sm:my-6 overflow-x-auto","children":["$","table",null,{"className":"w-full text-sm border-collapse","children":[["$","thead",null,{"children":["$","tr",null,{"className":"border-b border-hairline","children":[["$","th","1",{"className":"text-left px-4 py-3 font-semibold text-default","children":[["$","$1","t0-0",{"children":"Error"}]]}],["$","th","9",{"className":"text-left px-4 py-3 font-semibold text-default","children":[["$","$1","t0-0",{"children":"Cause"}]]}]]}]}],["$","tbody",null,{"children":[["$","tr","36",{"className":"border-b border-hairline","children":[["$","td","37",{"className":"px-4 py-3 text-default align-top","children":[["$","code","t0-0",{"className":"px-1.5 py-0.5 rounded text-[0.85em] font-mono bg-inset text-default border border-default","children":"UNAUTHENTICATED: Invalid API key format"}]]}],["$","td","81",{"className":"px-4 py-3 text-default align-top","children":[["$","$1","t0-0",{"children":"Key doesn't start with "}],["$","code","t0-23",{"className":"px-1.5 py-0.5 rounded text-[0.85em] font-mono bg-inset text-default border border-default","children":"sand_personal_"}],["$","$1","t0-39",{"children":" or is malformed"}]]}]]}],["$","tr","140",{"className":"border-b border-hairline","children":[["$","td","141",{"className":"px-4 py-3 text-default align-top","children":[["$","code","t0-0",{"className":"px-1.5 py-0.5 rounded text-[0.85em] font-mono bg-inset text-default border border-default","children":"KEY_NOT_FOUND: API key is not valid"}]]}],["$","td","181",{"className":"px-4 py-3 text-default align-top","children":[["$","$1","t0-0",{"children":"Key doesn't exist in the workspace"}]]}]]}],["$","tr","219",{"className":"border-b border-hairline","children":[["$","td","220",{"className":"px-4 py-3 text-default align-top","children":[["$","code","t0-0",{"className":"px-1.5 py-0.5 rounded text-[0.85em] font-mono bg-inset text-default border border-default","children":"KEY_REVOKED: API key is not valid"}]]}],["$","td","258",{"className":"px-4 py-3 text-default align-top","children":[["$","$1","t0-0",{"children":"Key has been revoked"}]]}]]}],["$","tr","282",{"className":"border-b border-hairline","children":[["$","td","283",{"className":"px-4 py-3 text-default align-top","children":[["$","code","t0-0",{"className":"px-1.5 py-0.5 rounded text-[0.85em] font-mono bg-inset text-default border border-default","children":"KEY_EXPIRED: API key is not valid"}]]}],["$","td","321",{"className":"px-4 py-3 text-default align-top","children":[["$","$1","t0-0",{"children":"Key has passed its expiration date"}]]}]]}],["$","tr","359",{"className":"border-b border-hairline","children":[["$","td","360",{"className":"px-4 py-3 text-default align-top","children":[["$","code","t0-0",{"className":"px-1.5 py-0.5 rounded text-[0.85em] font-mono bg-inset text-default border border-default","children":"FORBIDDEN: personal API key requires 'write' permission"}]]}],["$","td","420",{"className":"px-4 py-3 text-default align-top","children":[["$","$1","t0-0",{"children":"A "}],["$","code","t0-2",{"className":"px-1.5 py-0.5 rounded text-[0.85em] font-mono bg-inset text-default border border-default","children":"read"}],["$","$1","t0-8",{"children":" key attempted a mutation"}]]}]]}]]}]]}]}] 62:["$","$L4c","1804750124d0",{"id":"best-practices","as":"h2","className":"text-xl sm:text-2xl font-semibold mt-10 border-t border-hairline pt-10 mb-4 scroll-mt-20 text-default first:mt-0 first:border-t-0 first:pt-0","children":["Best practices"]}] 63:["$","ul","e883ac46fa0d-parent",{"className":"mb-4 space-y-2 text-sm sm:text-base text-secondary pl-0","children":[["$","li","e883ac46fa0d",{"className":"ml-6 pl-2 leading-relaxed text-secondary list-disc list-outside","children":[["$","strong","635aedec848f",{"children":["Use ",["$","code","b01589ae576f",{"className":"px-1.5 py-0.5 rounded text-[0.85em] font-mono bg-inset text-default border border-default","children":["read"]}]," keys for dashboards and monitoring."]}]," If your script only needs to fetch data, a read-only key limits the blast radius if it's ever compromised."]}],["$","li","c1cab87c9d5f",{"className":"ml-6 pl-2 leading-relaxed text-secondary list-disc list-outside","children":[["$","strong","b2654c575b00",{"children":["Set expiration dates."]}]," For one-off scripts or temporary integrations, set an expiry so the key auto-disables when no longer needed."]}],["$","li","3aa278519a13",{"className":"ml-6 pl-2 leading-relaxed text-secondary list-disc list-outside","children":[["$","strong","ff9d8290e0e5",{"children":["One key per integration."]}]," Create separate keys for separate use cases (CI pipeline, monitoring, local dev). This lets you revoke one without affecting others."]}],["$","li","43494f9e6597",{"className":"ml-6 pl-2 leading-relaxed text-secondary list-disc list-outside","children":[["$","strong","edc56aa98d77",{"children":["Rotate on a schedule."]}]," For long-lived integrations, rotate keys periodically. Rotation preserves permissions while invalidating the old secret."]}],["$","li","1c2b84b6c937",{"className":"ml-6 pl-2 leading-relaxed text-secondary list-disc list-outside","children":[["$","strong","b8511da86ef7",{"children":["Never commit keys to version control. "]}],"Use environment variables or a secrets manager. If a key is accidentally committed, rotate it immediately."]}],["$","li","e776fcac9271",{"className":"ml-6 pl-2 leading-relaxed text-secondary list-disc list-outside","children":[["$","strong","269b60134358",{"children":["Never use in client-side code. "]}],"Personal keys should only be used in server-side environments. For browser apps, use ",["$","a","84370ab1ba53-85",{"href":"/developers/authentication/oauth2","className":"font-medium hover:underline transition-colors wrap-break-word text-primary","target":"$undefined","rel":"$undefined","children":[["OAuth 2.0"],false]}],"."]}]]}] 64:["$","$L4c","b10ef51cd657",{"id":"when-to-use-workspace-keys-instead","as":"h2","className":"text-xl sm:text-2xl font-semibold mt-10 border-t border-hairline pt-10 mb-4 scroll-mt-20 text-default first:mt-0 first:border-t-0 first:pt-0","children":["When to use workspace keys instead"]}] 65:["$","p","0db314c516f1",{"className":"mb-4 leading-relaxed text-sm sm:text-base text-secondary","children":["If your integration isn't tied to a specific user — for example, a shared backend service, a Slack bot, or an automated pipeline — use a ",["$","a","81a8268242ff-137",{"href":"/developers/authentication/workspace-api-keys","className":"font-medium hover:underline transition-colors wrap-break-word text-primary","target":"$undefined","rel":"$undefined","children":[["workspace API key"],false]}]," instead. Workspace keys act as a service identity and offer resource-level scoping.",["$","br","node-3",{}],""]}] 66:["$","footer",null,{"className":"mt-12 pt-6 border-t border-hairline print:hidden","children":["$","div",null,{"className":"grid grid-cols-2 gap-4","children":[["$","$L6a",null,{"href":"/developers/authentication/authentication-overview","className":"group block rounded-lg border border-default p-4 hover:border-default transition-colors","children":[["$","span",null,{"className":"text-xs text-secondary","children":"Previous"}],["$","p",null,{"className":"text-sm font-medium text-default mt-1","children":["← ","Authentication overview"]}]]}],["$","$L6a",null,{"href":"/developers/authentication/workspace-api-keys","className":"group block rounded-lg border border-default p-4 hover:border-default transition-colors text-right","children":[["$","span",null,{"className":"text-xs text-secondary","children":"Next"}],["$","p",null,{"className":"text-sm font-medium text-default mt-1","children":["Workspace API keys"," →"]}]]}]]}]}]