> ## Documentation Index
> Fetch the complete documentation index at: https://docs.onstacks.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Automation toolings

> Manage API keys, webhooks, and operational health checks.

Developer routes are workspace-scoped and protected by bearer API key authentication.

## API keys

Use API key routes to create and revoke workspace API credentials.

| Endpoint                              | Purpose                  |
| ------------------------------------- | ------------------------ |
| `GET /v1/api-keys`                    | List workspace API keys. |
| `POST /v1/api-keys`                   | Create an API key.       |
| `POST /v1/api-keys/{apiKeyId}/revoke` | Revoke an API key.       |

Create an API key with:

```json theme={null}
{
  "name": "Treasury automation",
  "scopes": ["wallets:read", "transfers:create"],
  "expires_at": "2026-12-31T23:59:59Z"
}
```

The token is returned only when the key is created. Store it securely.

Available scopes:

* `wallets:read`
* `transfers:read`
* `transfers:create`
* `transfers:approve`
* `api_keys:manage`
* `admin:*`

## Webhooks

Use webhook routes to receive signed workspace events.

| Endpoint                                      | Purpose                    |
| --------------------------------------------- | -------------------------- |
| `GET /v1/webhooks`                            | List webhooks.             |
| `POST /v1/webhooks`                           | Create a webhook.          |
| `POST /v1/webhooks/{webhookId}/rotate-secret` | Rotate the signing secret. |
| `POST /v1/webhooks/{webhookId}/disable`       | Disable a webhook.         |
| `POST /v1/webhooks/{webhookId}/enable`        | Enable a webhook.          |

Create a webhook with:

```json theme={null}
{
  "name": "Production events",
  "url": "https://example.com/onstacks/webhooks"
}
```

The signing secret is returned when you create or rotate the webhook.

## Health checks

Use `GET /healthz` for liveness and `GET /readyz` for readiness.

## Environment scope

API key and webhook routes accept `environment=sandbox` or `environment=live`.