canonical: https://jentic.com/apis/keyzy.io/keyzy

# KEYZY API

Jentic publishes the only available OpenAPI specification for KEYZY API, keeping it validated and agent-ready. KEYZY is a key management service that lets applications retrieve their stored cryptographic and access keys through a single REST endpoint. The current public surface exposes a list-keys operation guarded by an X-API-Key header, intended for backend services that need to enumerate the keys associated with their KEYZY account. Use it as a lightweight inventory layer in front of a private secret store rather than a full vault.

## For AI agents

List the cryptographic and access keys held in a KEYZY account so an agent can confirm what keys are available before invoking downstream services.

## Scope

Does not handle secret retrieval, key rotation, or access policy enforcement - use for listing the keys held in a KEYZY account only.

## Capabilities

- Retrieve the inventory of keys associated with a KEYZY account
- Authenticate every request with an X-API-Key header for per-account isolation
- Confirm key availability before an agent attempts a downstream signing or auth operation
- Expose key metadata to backend services through a single REST call
- Audit which keys are present in an account from an automated workflow

## Use cases

### Pre-flight key inventory check

Before an automation invokes a service that requires a specific key, it can call GET /keys on KEYZY to confirm the key is present in the account. This avoids cryptic downstream auth failures and gives the operator a clear error path when a key is missing or unrotated.

Example prompt: Call GET /keys with X-API-Key and confirm that the expected key identifier is present before proceeding.

### Account audit and reporting

Compliance and operations teams can pull the list of keys held in each KEYZY account on a schedule and feed the result into an audit log or spreadsheet. The single endpoint makes the integration trivial to script and keeps the auditor out of the underlying secret store.

Example prompt: On a daily schedule, call GET /keys and write the returned identifiers to a compliance report row.

### Agent integration via Jentic

An agent that brokers requests to multiple key-aware services can use Jentic to discover the KEYZY list-keys operation, load its schema, and execute it with a scoped credential from your Jentic One instance. The agent never sees the X-API-Key directly, only the structured response.

Example prompt: Search Jentic for 'list keys in KEYZY', load the operation schema, and execute it to retrieve the current key inventory.

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| GET | `/keys` | List keys held in the account |

## Key resources

- **Keys** — List the keys held in the authenticated KEYZY account

## Why Jentic

- **Setup:** Wiring KEYZY by hand means learning its X-API-Key header auth and handling the api.keyzy.io host and its errors yourself. Through Jentic you install once, import KEYZY from the API Directory, store the key once, and your agent calls it.
- **Permission scoping:** The KEYZY key-listing endpoint takes no resource id in its URL path, so scope by operation: limit the agent to the operations it needs, such as listing the keys held in the account, and leave everything else out of the allowed set.
- **Credential handling:** Your KEYZY API key is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'list the keys in my KEYZY account', and Jentic returns the matching KEYZY operation with its input schema so the agent calls the right endpoint without browsing the reference docs.

## Related APIs

- **Akeyless Vault API** — Akeyless offers full vault, secret rotation, and access management; KEYZY only exposes a key inventory list
- **1Password Events API** — 1Password Events streams secret access events that complement a KEYZY-driven key inventory
- **HashiCorp Nomad API** — Nomad schedules workloads that may consume keys listed via KEYZY

## FAQ

### Why is there no official OpenAPI spec for KEYZY API?

KEYZY does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call KEYZY API via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.

### What authentication does the KEYZY API use?

Every request to https://api.keyzy.io must carry an X-API-Key header. Through Jentic, that key lives in your Jentic One instance and is injected at execution time, so the agent process never reads the raw value.

### Can I list the keys in my KEYZY account with the KEYZY API?

Yes. The single published operation is GET /keys, which returns the list of keys associated with the authenticated account. Use it for inventory and pre-flight checks, not for retrieving secret material itself.

### What are the rate limits for the KEYZY API?

The OpenAPI specification does not declare explicit rate limits for the /keys endpoint. Treat the operation as a low-volume inventory call; cache the result client-side rather than polling on every request.

### How do I list KEYZY keys with the KEYZY API through Jentic?

Run pip install jentic, then search Jentic for 'list keys in KEYZY', load the GET /keys schema, and execute it. The X-API-Key is supplied from the vault, and the response is returned as a structured object the agent can iterate over.

### Can I limit what my agent is allowed to do with the KEYZY API?

Yes. Because you run Jentic One yourself, your own rules decide which KEYZY operations and credentials the agent may use. Since the KEYZY endpoint takes no resource id in its path, you scope by operation: allow only the list-keys call (GET /keys) that returns the keys held in your account, and leave every other operation out of the agent's allowed set. Your X-API-Key stays in your own instance and is injected at execution time, so the agent can enumerate key names without ever reading the raw credential.