API keys, entities, functions, and secrets - Base44 Support Documentation

All endpoints on this page require compliance:inventory:read.

API keys

GET /{workspace_id}/api-keys Returns a credential-hygiene inventory of the workspace’s API keys. It contains metadata only, never key material. The key you hold appears here, which is intentional: the customer’s inventory is complete, and you can verify your own key’s scopes.

Field	Type	Notes
`id`	string	Matches `actor_id` on this API’s audit records.
`name`, `description`	string, string or null
`key_prefix`	string	Non-secret prefix, such as `b44k_a3f9c`.
`scopes[]`	array of strings	Fully resolved: the key’s own scopes, plus the scopes its `permission` grants while the key can act as the workspace owner. A pre-scoping legacy key reports its effective set, never empty.
`permission`	string or null	`full_access` or `read_only` when the key acts as the workspace owner across the workspace’s public API. The scopes it grants are listed in `scopes[]`. Null when the key holds only its scopes.
`status`	string	`active` or `disabled`. Disabled keys stay listed.
`created_date`, `created_by_email`	timestamp or null, string
`last_used_at`	timestamp or null	Hourly and asynchronous, so approximate.
`disabled_at`	timestamp or null
`expires_at`	null	Always null, because keys don’t expire today.

Entities

GET /{workspace_id}/entities Returns one row per app and entity: the app’s data-model schemas with their row-level security posture. It contains schema metadata only, never records, and never enum values, defaults, or descriptions, which can embed customer data.

Field	Type	Notes
`id`	string	`{app_id}:{entity_name}`.
`app_id`	string
`entity_name`	string	One row per entity the app defines.
`fields[]`	array	`{ name, type }` only. The type is null when untyped.
`rls.create`, `rls.read`, `rls.update`, `rls.delete`	string	`"open"` or `"restricted"` per operation.
`field_level_rls`	boolean	Any field carries its own rule.

The classification is resolved the way the engine resolves it. Update and delete inherit from write and then read, create never inherits, and a rule the write gate can’t evaluate is reported open, because it doesn’t in fact restrict the write. The raw rule shape is deliberately not returned, because rules embed customer literals. A rule such as { "data.tenant_id": "acme-corp-42" } is customer data rather than structure. Tell Base44 if you need rule detail. It can only be added, never changed.

Functions

GET /{workspace_id}/functions Returns one row per deployed backend function, including actors, which are stateful handlers reached over WebSocket. The two are distinguished by kind. Source is never returned.

Field	Type	Notes
`id`	string	`{app_id}:{name}`.
`app_id`	string
`name`	string	Also the route segment.
`url`	string or null	The function’s route on the app’s serving hostname, `https://{serving_hostname}/functions/{name}`, using the same hostname reported in Apps. `/api/functions/{name}` is an equivalent alias. Null when the app has no resolvable hostname.
`kind`	string	`"function"` or `"actor"`.
`internet_reachable`	boolean	Constant true, because no exposure toggle exists.
`auth_required`	null	Always null, because it’s enforced inside function code rather than platform config. See Security findings.
`triggers[]`	array	`{ type, is_active }`. Automatic invokers, from automations and workflows.
`required_app_user_connector_ids[]`	array of strings	Connectors an end user must connect for the function to run.

How to read triggers:

An empty list means no automatic invoker rather than an unused function. A function called from the app’s own UI has none, and its exposure is url plus internet_reachable.
Archived workflows are excluded. Paused ones appear with is_active set to false, since a paused workflow is one click from firing.
The type field passes the stored value through. Automations use scheduled, entity, and connector. Workflows add webhook, which is externally reachable over HTTP and worth treating as an external surface, plus in_app_agent, app_user_auth, app_publish, app_payment, and goal_file. Expect further values as new trigger types ship.

Secrets

GET /{workspace_id}/secrets Returns a metadata union of app-scoped and workspace-scoped secrets. Value fields don’t exist in the response at all, and the values are never loaded to produce it.

Field	Type	Notes
`id`	string
`scope`	string	`"app"` or `"workspace"`.
`app_id`	string or null	Null for workspace-scoped secrets.
`name`	string	Secret name only.
`created_date`, `created_by`	timestamp, string	The creating user’s email.
`last_updated_at`	timestamp or null	Rotation proxy: the last time the value was written. See Privacy and gaps.
`encryption_mode`	string	`fernet` or `kms_envelope`.

​API keys

​Entities

​Functions

​Secrets

API keys

Entities

Functions

Secrets