Class ApiKeyDescriptor

Namespace

Stratara.Abstractions.ApiKeys

Assembly

Stratara.Abstractions.dll

The stored, non-secret description of an issued API key. The raw key itself is never persisted — only its hash — so a descriptor can be listed and audited freely.

[ExcludeFromCodeCoverage]
public sealed record ApiKeyDescriptor : IEquatable<ApiKeyDescriptor>

Inheritance

object

ApiKeyDescriptor

Implements

IEquatable<ApiKeyDescriptor>

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Extension Methods

FieldChangedEventExtensions.ApplyPropertyChanged<TAggregate>(TAggregate, FieldChangedEvent<TAggregate>)

EventStream.ApplyEvents(object, IReadOnlyList<IEvent>)

Remarks

Two kinds share this shape: machine keys (UserId is null) act as their own principal — the key id is the actor — and carry tenant-scoped Roles; personal access tokens (UserId set) act as the bound user, whose own memberships and roles apply, so Roles is empty for them.

Constructors

ApiKeyDescriptor(Guid, Guid, Guid?, string, IReadOnlyCollection<string>, DateTimeOffset, DateTimeOffset?, DateTimeOffset?)

The stored, non-secret description of an issued API key. The raw key itself is never persisted — only its hash — so a descriptor can be listed and audited freely.

public ApiKeyDescriptor(Guid Id, Guid TenantId, Guid? UserId, string Name, IReadOnlyCollection<string> Roles, DateTimeOffset CreatedAt, DateTimeOffset? ExpiresAt = null, DateTimeOffset? RevokedAt = null)

Parameters

Id Guid

The key's stable identity (also the machine key's actor id).

TenantId Guid

The tenant the key is bound to.

UserId Guid?

The bound user for personal access tokens; null for machine keys.

Name string

Display name for administration ("CI deploy key").

Roles IReadOnlyCollection<string>

Tenant-scoped roles for machine keys; empty for personal access tokens.

CreatedAt DateTimeOffset

Issuance timestamp.

ExpiresAt DateTimeOffset?

Optional expiry; the key stops validating once passed.

RevokedAt DateTimeOffset?

Revocation timestamp; a revoked key never validates again.

Remarks

Two kinds share this shape: machine keys (UserId is null) act as their own principal — the key id is the actor — and carry tenant-scoped Roles; personal access tokens (UserId set) act as the bound user, whose own memberships and roles apply, so Roles is empty for them.

Properties

CreatedAt

Issuance timestamp.

public DateTimeOffset CreatedAt { get; init; }

Property Value

DateTimeOffset

ExpiresAt

Optional expiry; the key stops validating once passed.

public DateTimeOffset? ExpiresAt { get; init; }

Property Value

DateTimeOffset?

Id

The key's stable identity (also the machine key's actor id).

public Guid Id { get; init; }

Property Value

Guid

Name

Display name for administration ("CI deploy key").

public string Name { get; init; }

Property Value

string

RevokedAt

Revocation timestamp; a revoked key never validates again.

public DateTimeOffset? RevokedAt { get; init; }

Property Value

DateTimeOffset?

Roles

Tenant-scoped roles for machine keys; empty for personal access tokens.

public IReadOnlyCollection<string> Roles { get; init; }

Property Value

IReadOnlyCollection<string>

TenantId

The tenant the key is bound to.

public Guid TenantId { get; init; }

Property Value

Guid

UserId

The bound user for personal access tokens; null for machine keys.

public Guid? UserId { get; init; }

Property Value

Guid?