{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://tune.toys/schemas/platform/api-key.schema.json",
  "title": "ApiKey",
  "description": "Metadata of one developer API key. The secret is returned once at creation or rotation and never stored in plain text.",
  "type": "object",
  "additionalProperties": false,
  "properties": {
    "id": { "$ref": "common.schema.json#/$defs/EntityId" },
    "appId": { "$ref": "common.schema.json#/$defs/EntityId" },
    "name": { "type": "string", "minLength": 1, "maxLength": 64 },
    "prefix": {
      "type": "string",
      "pattern": "^[a-z2-7]{8}$",
      "description": "Public identifier shown in the UI and logs as tt_<prefix>_…"
    },
    "scopes": {
      "type": "array",
      "minItems": 1,
      "maxItems": 9,
      "uniqueItems": true,
      "items": { "$ref": "enums.schema.json#/$defs/ApiKeyScope" }
    },
    "ipAllowlist": {
      "type": "array",
      "maxItems": 16,
      "items": { "type": "string", "minLength": 2, "maxLength": 64 },
      "description": "Optional CIDR entries evaluated against the socket address; empty allows any address."
    },
    "createdAt": { "$ref": "common.schema.json#/$defs/Timestamp" },
    "expiresAt": { "$ref": "common.schema.json#/$defs/Timestamp" },
    "lastUsedAt": {
      "anyOf": [
        { "$ref": "common.schema.json#/$defs/Timestamp" },
        { "type": "null" }
      ]
    },
    "revokedAt": {
      "anyOf": [
        { "$ref": "common.schema.json#/$defs/Timestamp" },
        { "type": "null" }
      ]
    },
    "replacedBy": {
      "anyOf": [
        { "$ref": "common.schema.json#/$defs/EntityId" },
        { "type": "null" }
      ]
    },
    "version": { "type": "integer", "minimum": 1 }
  },
  "required": [
    "id",
    "appId",
    "name",
    "prefix",
    "scopes",
    "ipAllowlist",
    "createdAt",
    "expiresAt",
    "lastUsedAt",
    "revokedAt",
    "replacedBy",
    "version"
  ]
}