Scenario #9710: An Api Key Can Inspect Its Own Properties

GET /api/rbac/context returns the properties of the API-key used to authenticate the request (property apiKey): its endpoint-scopes and its expiry timestamp, besides the related API_KEY subject itself. This endpoint is always allowed, even for endpoint-scoped API-keys, to support such self-inspection.

Properties

Given

name	value
subjectUuid	a91c000a-0000-0000-0000-00000000000a
subjectName	self.inspecting.key

Create an endpoint-scoped API_KEY Subject with an expiry timestamp

The response contains the generated clear-text API-key (property apiKey) exactly once; it cannot be retrieved again.

HTTP POST "/api/rbac/subjects" \
  -H "Authorization: Bearer $HSADMINNG_JWT_BEARER" \
  `# {` \
  `#   "sub" : "uuid<hsh-alex_superuser>"` \
  `# }` \
  <<EOF
{
  "uuid" : "a91c000a-0000-0000-0000-00000000000a",
  "name" : "self.inspecting.key",
  "type" : "API_KEY",
  "scopes" : [ "rbac.subjects:sync" ],
  "expiresAt" : "2030-01-01T00:00:00Z"
}
EOF
=> status: 201 CREATED a91c000a-0000-0000-0000-00000000000a
{
  "uuid" : "a91c000a-0000-0000-0000-00000000000a",
  "name" : "self.inspecting.key",
  "organization" : "self",
  "type" : "API_KEY",
  "apiKey" : "hsak_self.inspecting.key.61204b051e4788b8c91c2e5fed11d83d915b71b8976b3d9c358af7c77c333873",
  "scopes" : [ "rbac.subjects:sync" ],
  "expiresAt" : "2030-01-01T00:00:00Z"
}

Inspect the API-key’s own properties, authenticated just by the API-key

HTTP GET "/api/rbac/context" \
  -H "Hostsharing-Api-Key: $HSADMINNG_API_KEY"
=> status: 200 OK 
{
  "subject" : {
    "uuid" : "a91c000a-0000-0000-0000-00000000000a",
    "name" : "self.inspecting.key",
    "organization" : null,
    "type" : "API_KEY"
  },
  "assumedRoles" : [ ],
  "claimedGroups" : [ ],
  "effectiveGroups" : [ ],
  "globalAdmin" : false,
  "apiKey" : {
    "scopes" : [ "rbac.subjects:sync" ],
    "expiresAt" : "2030-01-01T00:00:00Z"
  }
}

---

generated on 2026-08-10 03:08:48 for branch HEAD