credentials

GET /credential

Describe the calling credential

Credential introspection (WP-A9 req 9). A secret API key of any scope gets its own context (org, project, environment, prefix, scopes, purposes); rows are read fresh, and a revoked key is 401. A registered application (Google ID token, WP-A9) gets its id, status, allow-list fingerprint and per-class limits; when the X-Tessera-Project and X-Tessera-Environment headers name a project it owns, the org, project and environment are filled, and headers naming any other project get the uniform 404. Publishable keys and console sessions get 403. Nothing secret is ever returned.

Operation ID: getCredentialContext · Service: gateway-api

Authentication

• apiKey (http (bearer)) — Project API key (003 §2): tsk_live_… or tsk_test_… in Authorization: Bearer. Scoped to exactly one project + environment; scopes are a subset of ingest, read, admin. Keys are stored hashed and shown once at creation.
• applicationToken (http (bearer)) — A registered partner application's Google-signed OIDC ID token (WP-A9): minted by the application's own workload identity with the environment's exact audience, and pinned on the service account's email and unique id. Only registered applications are accepted.

Responses

Status	Schema	Description
200	CredentialContext	The calling credential's context.
default	ErrorEnvelope	Error response (003 §1). Every non-2xx response uses this envelope; the HTTP status matches error.code. Rate-limited requests get 429 resource_exhausted with retry_after_seconds and a Retry-After header; the X-RateLimit-* headers ride on EVERY response, success or error (003 §1; plan-driven per API key + endpoint class — WP-B2). A 503 unavailable carries retry_after_seconds too for a lock-wait timeout (SQLSTATE 55P03), a rule preview at capacity (preview_capacity_exhausted), or a label preview during which the erasure of every entity holding its censor clock began (label_preview_clock_entity_erased): how long to wait before retrying.

GET /credential/owned

List what the calling application owns

Credential introspection (WP-A9 req 9, slice 4; applications only). Every organization the calling application created, ordered by org_id (ULIDs, so creation order, oldest first) and cursor-paginated, each with every project the application created in it (ordered by project_id, with the environments the application may act in). Every status is listed, deleting and deleted included; nothing the application did not create appears. A separate operation, so the GET /credential response keeps its shape. The scoping headers do not change the listing: they are ignored when they name an owned project, and otherwise get the usual answers (the uniform 404, or 403 environment_not_allowed). Sessions and API keys get 403.

Operation ID: listCredentialOwned · Service: gateway-api

Authentication

• applicationToken (http (bearer)) — A registered partner application's Google-signed OIDC ID token (WP-A9): minted by the application's own workload identity with the environment's exact audience, and pinned on the service account's email and unique id. Only registered applications are accepted.

Parameters

Name	In	Required	Type	Description
cursor	query	no	string	Opaque pagination cursor from a previous response's next_cursor.
limit	query	no	integer	Page size (cursor pagination, 003 §1). Maximum 200.

Pagination

Cursor pagination (003 §1): pass limit (max 200) and cursor; the response is the pagination envelope — data plus next_cursor (null on the last page).

Responses

Status	Schema	Description
200	CredentialOwnedPage	A page of owned organizations, each with its owned projects.
default	ErrorEnvelope	Error response (003 §1). Every non-2xx response uses this envelope; the HTTP status matches error.code. Rate-limited requests get 429 resource_exhausted with retry_after_seconds and a Retry-After header; the X-RateLimit-* headers ride on EVERY response, success or error (003 §1; plan-driven per API key + endpoint class — WP-B2). A 503 unavailable carries retry_after_seconds too for a lock-wait timeout (SQLSTATE 55P03), a rule preview at capacity (preview_capacity_exhausted), or a label preview during which the erasure of every entity holding its censor clock began (label_preview_clock_entity_erased): how long to wait before retrying.

Errors

Every non-2xx response uses the 003 §1 error envelope; error.request_id matches the X-Request-Id response header, and the HTTP status always matches error.code:

{
  "error": {
    "code": "invalid_argument",
    "details": [
      {
        "type": "field_violation"
      }
    ],
    "message": "human-readable",
    "request_id": "req_01hxample"
  }
}

Closed error-code set (003 §1): invalid_argument, unauthenticated, permission_denied, not_found, already_exists, failed_precondition, resource_exhausted, internal, unavailable.

resource_exhausted responses (HTTP 429) additionally carry retry_after_seconds. See ErrorEnvelope.