> ## Documentation Index
> Fetch the complete documentation index at: https://arize-ax.mintlify.site/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Create an API key

> Create a new API key for the authenticated user.

- Choose `key_type: "USER"` for a personal key that authenticates as you, or
  `key_type: "SERVICE"` for an automated service account key. The field is required.
- For service keys, supply at least one space via the `organizations` array. The service
  account is granted membership in each specified space. Multiple organizations and multiple
  spaces per organization are supported.
- For `USER` keys, the key inherits the authenticated user's own permissions.
- You may only assign roles at or below your own privilege level. Attempting to
  assign a role higher than your own returns `422 Unprocessable Entity`.
- All roles default to minimum privilege when omitted: space roles default to `MEMBER`,
  organization roles default to `READ_ONLY`, and `account_role` defaults to `MEMBER`.

**Authorization:**
- **User keys:** Requires the `developer` user permission flag. Returns `403` when this flag is absent.
- **Service keys:** Requires the `SERVICE_KEY_CREATE` permission in the target space (space
  member or above).

The full API key value (`key`) is **only returned once** in the creation response.
Store it securely — it cannot be retrieved again. Use the `redacted_key` field on
subsequent reads.

<Note>This endpoint is in beta, read more [here](https://arize.com/docs/ax/rest-reference#api-version-stages).</Note>




## OpenAPI

````yaml https://api.arize.com/v2/spec.yaml post /v2/api-keys
openapi: 3.0.3
info:
  title: Arize REST API
  version: 2.0.0
  description: |
    API specification for the backend data server. The API is hosted globally
    at https://api.arize.com/v2 or in your own environment.
  license:
    name: Apache-2.0
    url: https://www.apache.org/licenses/LICENSE-2.0
servers:
  - description: Global
    url: https://api.arize.com
  - description: Regional
    url: https://api.{region}.arize.com
    variables:
      region:
        default: eu-west-1a
        enum:
          - eu-west-1a
          - ca-central-1a
  - description: Custom Host
    url: https://{host}
    variables:
      host:
        default: api.arize.com
security:
  - bearerAuth: []
tags:
  - name: AI Integrations
    description: |
      AI integrations configure access to external LLM providers (e.g. OpenAI,
      Azure OpenAI, AWS Bedrock, Vertex AI). Integrations can be scoped to the
      entire account, a specific organization, or a specific space.
  - name: Annotation Configs
    description: >
      Annotation configs allow you to define consistent annotation schemas that

      can be reused across your workspace, ensuring evaluations are structured
      and

      comparable over time.
  - name: Annotation Queues
    description: >
      Annotation queues help you organize and manage human evaluation workflows.

      Use queues to assign spans or examples to annotators for review and
      labeling.
  - name: API Keys
    description: >
      API keys are used to authenticate requests to the Arize API. List your
      keys

      to view metadata; the raw secret is never returned after creation.
  - name: Audit Logs
    description: >
      Audit logs record authenticated user actions within an account, providing
      a

      chronological trail for security and compliance review. Access requires

      account admin privileges and audit logging to be enabled.
  - name: Datasets
    description: |
      Datasets are structured, version-controlled example collections you use to
      run, evaluate, and track LLM experiments.
  - name: Evaluators
    description: >
      Evaluators are reusable evaluation configurations used to assess the
      quality

      of LLM outputs. They can be template-based (using LLM judges) or
      code-based.
  - name: Experiments
    description: >
      Experiments let you systematically test prompt/model changes using
      datasets,

      tasks, and evaluators.
  - name: Integrations
    description: >
      Integrations configure access to external LLM providers (e.g. OpenAI,

      Azure OpenAI, AWS Bedrock, Vertex AI), notifications services (e.g.
      PagerDuty, Slack), and

      your own agents. Integrations can be scoped to the entire account, a
      specific

      organization, or a specific space.
  - name: Monitors
    description: >
      Monitors continuously track a metric over your model or LLM application
      data

      and alert you when it crosses a threshold. Each monitor watches a single

      metric - data quality, model performance, drift, a custom metric, or a

      tracing metric - and moves between statuses as the metric passes in and
      out of its 

      healthy range.
  - name: Organizations
    description: >
      Organizations are top-level containers within an Arize AX account for
      grouping spaces.
  - name: Projects
    description: |
      Projects represent LLM applications being monitored in Arize where you can
      observe traces and spans.
  - name: Prompts
    description: >
      Prompts are reusable, versioned templates for LLM interactions. Use
      prompts

      to standardize and manage how you interact with LLMs across your
      application.
  - name: Resource Restrictions
    description: |
      Endpoints for restricting and unrestricting resources (projects, models).
  - name: Role Bindings
    description: |
      Role bindings assign a role to a user on a resource. REST currently
      supports space- and project-scoped bindings.
  - name: Roles
    description: >
      Roles define sets of permissions that can be assigned to users within an

      account. Create custom roles to tailor access control to your team's
      needs.
  - name: Spaces
    description: >
      Spaces are containers within an organization for grouping related
      projects,

      datasets, and experiments, enabling collaboration or isolated
      experimentation

      with role-based access control.
  - name: Spans
    description: |
      Spans represent individual operations within a trace. A span captures the
      timing, status, and attributes of a single operation in your application.
  - name: Tasks
    description: |
      Tasks are configurable units of work that tie one or more evaluators to a
      data source (project or dataset). Use tasks to automate evaluation of LLM
      outputs, with support for continuous evaluation and backfill runs.
  - name: Traces
    description: |
      A trace is the collection of spans sharing a trace ID, representing a
      single end-to-end request through an LLM application. Use the Traces
      endpoint to retrieve traces with all of their spans in one call.
  - name: Users
    description: >
      Users represent members of an account. The Users endpoints allow creating,

      listing, updating (display name), and removing users from the account
      programmatically.
paths:
  /v2/api-keys:
    post:
      tags:
        - API Keys
      summary: Create an API key
      description: >
        Create a new API key for the authenticated user.


        - Choose `key_type: "USER"` for a personal key that authenticates as
        you, or
          `key_type: "SERVICE"` for an automated service account key. The field is required.
        - For service keys, supply at least one space via the `organizations`
        array. The service
          account is granted membership in each specified space. Multiple organizations and multiple
          spaces per organization are supported.
        - For `USER` keys, the key inherits the authenticated user's own
        permissions.

        - You may only assign roles at or below your own privilege level.
        Attempting to
          assign a role higher than your own returns `422 Unprocessable Entity`.
        - All roles default to minimum privilege when omitted: space roles
        default to `MEMBER`,
          organization roles default to `READ_ONLY`, and `account_role` defaults to `MEMBER`.

        **Authorization:**

        - **User keys:** Requires the `developer` user permission flag. Returns
        `403` when this flag is absent.

        - **Service keys:** Requires the `SERVICE_KEY_CREATE` permission in the
        target space (space
          member or above).

        The full API key value (`key`) is **only returned once** in the creation
        response.

        Store it securely — it cannot be retrieved again. Use the `redacted_key`
        field on

        subsequent reads.


        <Note>This endpoint is in beta, read more
        [here](https://arize.com/docs/ax/rest-reference#api-version-stages).</Note>
      operationId: create_api_key
      requestBody:
        $ref: '#/components/requestBodies/CreateApiKeyRequestBody'
      responses:
        '201':
          $ref: '#/components/responses/CreateApiKeyResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '422':
          $ref: '#/components/responses/UnprocessableEntity'
        '429':
          $ref: '#/components/responses/RateLimitExceeded'
components:
  requestBodies:
    CreateApiKeyRequestBody:
      description: Body containing API key creation parameters
      required: true
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/CreateApiKeyRequest'
          examples:
            user_key_minimal:
              summary: User key (minimal)
              value:
                key_type: USER
                name: My dev key
            user_key_with_expiry:
              summary: User key with expiry
              value:
                key_type: USER
                name: CI pipeline key
                description: Expires after one year.
                expires_at: '2026-01-01T00:00:00Z'
            service_key_minimal:
              summary: Service key — minimal (single space, all defaults)
              value:
                key_type: SERVICE
                name: CI pipeline key
                organizations:
                  - org_id: T3JnYW5pemF0aW9uOjEwMDE6eFl6Vw
                    spaces:
                      - space_id: U3BhY2U6MjAwMTphQmNE
            service_key_multi_space:
              summary: Service key — multi-space with explicit roles
              value:
                key_type: SERVICE
                name: ML platform key
                description: Uploads eval results and reads traces across two spaces
                account_role:
                  type: PREDEFINED
                  name: MEMBER
                organizations:
                  - org_id: T3JnYW5pemF0aW9uOjEwMDE6eFl6Vw
                    role:
                      type: PREDEFINED
                      name: MEMBER
                    spaces:
                      - space_id: U3BhY2U6MjAwMTphQmNE
                        role:
                          type: PREDEFINED
                          name: ADMIN
                      - space_id: U3BhY2U6MjAwMjphQmNE
                        role:
                          type: CUSTOM
                          id: Um9sZTozMDAxOnFSc1Q
                expires_at: '2027-01-01T00:00:00Z'
  responses:
    CreateApiKeyResponse:
      description: >-
        API key successfully created or refreshed. The raw key is only returned
        once.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/CreateApiKeyResponse'
          examples:
            user_key:
              summary: User API key created
              value:
                id: QXBpS2V5OjEwMDE6YUJjRA==
                name: My dev key
                key_type: USER
                status: ACTIVE
                key: ak-abc123def456ghi789jkl012mno345pqr678stu901vwx234yz
                redacted_key: ak-abc...xyz
                created_by_user_id: VXNlcjoxMDAxOm5OYkM=
                created_at: '2024-01-15T10:30:00Z'
                expires_at: '2025-01-15T10:30:00Z'
            service_key:
              summary: Service API key created
              value:
                id: QXBpS2V5OjEwMDI6YUJjRA==
                name: CI pipeline key
                key_type: SERVICE
                status: ACTIVE
                key: ak-def456ghi789jkl012mno345pqr678stu901vwx234yzabc123
                redacted_key: ak-def...abc
                created_by_user_id: VXNlcjoxMDAxOm5OYkM=
                created_at: '2024-01-15T10:30:00Z'
                bot_user:
                  id: VXNlcjo5MDAxOm5OYkM=
                  name: CI pipeline key [bot]
                  account_role:
                    type: PREDEFINED
                    name: MEMBER
                  organizations:
                    - org_id: T3JnYW5pemF0aW9uOjEwMDE6eFl6Vw
                      role:
                        type: PREDEFINED
                        name: READ_ONLY
                      spaces:
                        - space_id: U3BhY2U6MjAwMTphQmNE
                          role:
                            type: PREDEFINED
                            name: MEMBER
    BadRequest:
      description: Invalid request
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/Problem'
          example:
            status: 400
            title: Invalid request parameters
            detail: The 'name' field is required and must be a non-empty string.
            instance: /resource
            type: https://arize.com/docs/ax/rest-reference/errors#invalid-request
    Unauthorized:
      description: Authentication is required
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/Problem'
          example:
            status: 401
            title: Authentication required
            detail: You must be authenticated to access this resource.
            instance: /resource
            type: >-
              https://arize.com/docs/ax/rest-reference/errors#authentication-required
    Forbidden:
      description: Insufficient permissions to access this resource
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/Problem'
          example:
            status: 403
            title: Access forbidden
            detail: You do not have permission to access this resource.
            instance: /resource/12345
            type: https://arize.com/docs/ax/rest-reference/errors#access-forbidden
    NotFound:
      description: Not found
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/Problem'
          example:
            status: 404
            title: Resource not found
            detail: The requested resource with ID '12345' was not found.
            instance: /resource/12345
            type: https://arize.com/docs/ax/rest-reference/errors#resource-not-found
    UnprocessableEntity:
      description: Unprocessable entity
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/Problem'
          example:
            status: 422
            title: Unprocessable Entity
            detail: One or more fields failed validation.
            instance: /resource/12345
            type: >-
              https://arize.com/docs/ax/rest-reference/errors#unprocessable-entity
    RateLimitExceeded:
      description: Rate limit exceeded
      headers:
        Retry-After:
          description: |
            When throttled (429), how long to wait before retrying. Value is
            either a delta-seconds integer.
          schema:
            type: integer
            minimum: 0
          example: 42
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/Problem'
          example:
            status: 429
            title: Rate limit exceeded
            detail: >-
              You have exceeded the allowed number of requests. Please try again
              later.
            instance: /resource
            type: >-
              https://arize.com/docs/ax/rest-reference/errors#rate-limit-exceeded
  schemas:
    CreateApiKeyRequest:
      type: object
      required:
        - key_type
      properties:
        key_type:
          allOf:
            - $ref: '#/components/schemas/ApiKeyType'
          description: >
            The type of key to create. Use `"USER"` for a personal key that
            authenticates

            as you with your current permissions. Use `"SERVICE"` for a key tied
            to a

            dedicated service account with its own explicitly configured access
            across

            one or more spaces.
      discriminator:
        propertyName: key_type
        mapping:
          USER:
            $ref: '#/components/schemas/CreateUserApiKeyRequest'
          SERVICE:
            $ref: '#/components/schemas/CreateServiceApiKeyRequest'
      oneOf:
        - $ref: '#/components/schemas/CreateUserApiKeyRequest'
        - $ref: '#/components/schemas/CreateServiceApiKeyRequest'
      description: >
        Request body for creating an API key. Set `key_type` to select the kind
        of key:

        - `USER` — authenticates as the creating user, inheriting their current
        permissions.

        - `SERVICE` — authenticates as a service account: a dedicated,
        automatically provisioned
          identity with roles explicitly configured in the spaces you specify. Use this for
          automation, CI/CD pipelines, or any workload that should run independently of a
          specific user.
    CreateApiKeyResponse:
      oneOf:
        - $ref: '#/components/schemas/UserApiKeyCreated'
        - $ref: '#/components/schemas/ServiceApiKeyCreated'
      discriminator:
        propertyName: key_type
        mapping:
          USER:
            $ref: '#/components/schemas/UserApiKeyCreated'
          SERVICE:
            $ref: '#/components/schemas/ServiceApiKeyCreated'
      description: >
        Response for a newly created or refreshed API key. The `key_type` field
        discriminates the variant:

        - `USER` — standard user key; no bot user.

        - `SERVICE` — service key tied to a service account; includes a
        `bot_user` with the service account's resolved role assignments.
    Problem:
      type: object
      description: RFC 9457 Problem Details
      properties:
        title:
          type: string
          description: A short, human-readable summary of the problem type
        status:
          type: integer
          description: >-
            The HTTP status code generated by the origin server for this
            occurrence of the problem
        type:
          type: string
          format: uri-reference
          description: A URI reference that identifies the problem type
        detail:
          type: string
          description: >-
            A human-readable explanation specific to this occurrence of the
            problem
        instance:
          type: string
          format: uri-reference
          description: >-
            A URI reference that identifies the specific occurrence of the
            problem
      required:
        - title
        - status
      additionalProperties: false
    ApiKeyType:
      type: string
      enum:
        - USER
        - SERVICE
      description: >
        Type of the API key.

        - USER - Personal key that authenticates as the creating user.

        - SERVICE - Key that authenticates as a service account with explicitly
        granted access.
    CreateUserApiKeyRequest:
      type: object
      required:
        - key_type
        - name
      properties:
        key_type:
          type: string
          enum:
            - USER
          description: Must be `"USER"`.
        name:
          type: string
          maxLength: 256
          description: User-defined name for the API key.
          example: My dev key
        description:
          type: string
          maxLength: 1000
          description: Optional user-defined description for the API key.
          example: Used for local development.
        expires_at:
          type: string
          format: date-time
          description: Optional expiration timestamp. If omitted the key never expires.
          example: '2026-01-01T00:00:00Z'
      additionalProperties: false
    CreateServiceApiKeyRequest:
      type: object
      required:
        - key_type
        - name
        - organizations
      properties:
        key_type:
          type: string
          enum:
            - SERVICE
          description: Must be `"SERVICE"`.
        name:
          type: string
          maxLength: 256
          description: User-defined name for the API key.
          example: CI pipeline key
        description:
          type: string
          maxLength: 1000
          description: Optional user-defined description for the API key.
          example: Key used by the CI pipeline to upload evaluation results.
        expires_at:
          type: string
          format: date-time
          description: Optional expiration timestamp. If omitted the key never expires.
          example: '2026-01-01T00:00:00Z'
        account_role:
          allOf:
            - $ref: '#/components/schemas/UserRoleAssignment'
          default:
            type: PREDEFINED
            name: MEMBER
          description: >
            Account-level role for the bot user. Only predefined roles are
            supported at this level.

            Custom account roles (`{ "type": "CUSTOM", "id": "..." }`) are not
            yet supported and return `422`.

            Support will be added in a future release.

            Defaults to `{ type: PREDEFINED, name: MEMBER }` when omitted.

            Must be at or below the caller's own account role.

            The `ANNOTATOR` role is not valid for service keys and returns
            `422`.
        organizations:
          type: array
          minItems: 1
          maxItems: 100
          uniqueItems: true
          description: >
            Organizations the service account should have access to. Each entry
            specifies an organization

            and the spaces within it. Must include at least one organization
            with at least one space.

            All spaces must belong to the organization they are listed under.
          items:
            $ref: '#/components/schemas/ServiceKeyOrgAssignment'
      additionalProperties: false
    UserApiKeyCreated:
      allOf:
        - $ref: '#/components/schemas/ApiKey'
        - type: object
          required:
            - key
          properties:
            key_type:
              type: string
              enum:
                - USER
              description: Discriminator value for user keys.
            key:
              type: string
              description: >
                The full API key value. **Only returned once** at creation or
                refresh time.

                Store it securely — it cannot be retrieved again.
    ServiceApiKeyCreated:
      allOf:
        - $ref: '#/components/schemas/ApiKey'
        - type: object
          required:
            - key
            - bot_user
          properties:
            key_type:
              type: string
              enum:
                - SERVICE
              description: Discriminator value for service keys.
            key:
              type: string
              description: >
                The full API key value. **Only returned once** at creation or
                refresh time.

                Store it securely — it cannot be retrieved again.
            bot_user:
              $ref: '#/components/schemas/ServiceKeyBotUser'
              description: >-
                The bot user created for this service key, including their
                resolved role assignments.
    UserRoleAssignment:
      oneOf:
        - $ref: '#/components/schemas/PredefinedUserRoleAssignment'
        - $ref: '#/components/schemas/CustomUserRoleAssignment'
      discriminator:
        propertyName: type
        mapping:
          PREDEFINED:
            $ref: '#/components/schemas/PredefinedUserRoleAssignment'
          CUSTOM:
            $ref: '#/components/schemas/CustomUserRoleAssignment'
      description: >
        An account-level role assignment. Discriminated by `type`:

        - `PREDEFINED`: one of the predefined roles (`admin`, `member`,
        `annotator`)

        - `CUSTOM`: a custom RBAC role identified by its ID


        Note: `CUSTOM` role assignments are not yet supported and are reserved
        for future use.
    ServiceKeyOrgAssignment:
      type: object
      required:
        - org_id
        - spaces
      properties:
        org_id:
          type: string
          description: ID of the organization to grant the service account access to.
          example: T3JnYW5pemF0aW9uOjEwMDE6eFl6Vw
        role:
          allOf:
            - $ref: '#/components/schemas/OrganizationRoleAssignment'
          default:
            type: PREDEFINED
            name: READ_ONLY
          description: >
            Role for the bot user within this organization. Only predefined
            roles are supported at this level.

            Custom org roles (`{ "type": "CUSTOM", "id": "..." }`) are not yet
            supported and return `422`.

            Support will be added in a future release.

            Defaults to `{ type: PREDEFINED, name: READ_ONLY }` when omitted.

            Must be at or below the caller's own effective organization role.

            The `ANNOTATOR` role is not valid for service keys and returns
            `422`.
        spaces:
          type: array
          minItems: 1
          maxItems: 100
          uniqueItems: true
          description: >
            Spaces within this organization the service account should have
            access to. Each entry specifies

            a space and optional role. All space IDs must belong to this
            organization.
          items:
            $ref: '#/components/schemas/ServiceKeySpaceAssignment'
      additionalProperties: false
    ApiKey:
      type: object
      required:
        - id
        - name
        - key_type
        - status
        - redacted_key
        - created_at
        - created_by_user_id
      properties:
        id:
          type: string
          description: Unique identifier for the API key.
        name:
          type: string
          description: User-defined name for the API key.
        description:
          type: string
          description: Optional user-defined description for the API key.
        key_type:
          $ref: '#/components/schemas/ApiKeyType'
        status:
          $ref: '#/components/schemas/ApiKeyStatus'
        redacted_key:
          type: string
          description: >-
            Redacted version of the key suitable for display (e.g.,
            "ak-abc...xyz").
        created_at:
          type: string
          format: date-time
          description: Timestamp when the key was created.
        expires_at:
          type: string
          format: date-time
          description: Optional timestamp when the key will expire.
        created_by_user_id:
          type: string
          description: ID of the user who created the key.
        last_used_at:
          type: string
          format: date-time
          description: >-
            Approximate timestamp when the key was last used for authentication.
            This value is periodically updated and may not reflect the most
            recent usage.
      additionalProperties: false
    ServiceKeyBotUser:
      type: object
      required:
        - id
        - name
        - account_role
        - organizations
      properties:
        id:
          type: string
          description: Global ID of the bot user.
        name:
          type: string
          description: Display name of the bot user.
        account_role:
          allOf:
            - $ref: '#/components/schemas/UserRoleAssignment'
          description: >-
            Account-level role assigned to the bot user. Always present —
            defaults are resolved server-side.
        organizations:
          type: array
          minItems: 1
          items:
            $ref: '#/components/schemas/ServiceKeyBotUserOrgAssignment'
          description: >-
            Organization access assignments for the service account, each
            containing nested space assignments.
      additionalProperties: false
    PredefinedUserRoleAssignment:
      type: object
      description: A predefined account-level role assignment.
      required:
        - type
        - name
      properties:
        type:
          allOf:
            - $ref: '#/components/schemas/UserRoleAssignmentType'
          default: PREDEFINED
          description: >-
            Discriminator identifying this as a predefined role assignment. Must
            be `PREDEFINED`.
        name:
          $ref: '#/components/schemas/UserRole'
      additionalProperties: false
    CustomUserRoleAssignment:
      type: object
      description: A custom RBAC role assignment.
      required:
        - type
        - id
      properties:
        type:
          allOf:
            - $ref: '#/components/schemas/UserRoleAssignmentType'
          default: CUSTOM
          description: >-
            Discriminator identifying this as a custom role assignment. Must be
            `CUSTOM`.
        id:
          allOf:
            - $ref: '#/components/schemas/Id'
          description: The unique identifier of the custom RBAC role.
        name:
          type: string
          readOnly: true
          description: |
            Human-readable name of the custom role.
            Returned in responses only; ignored on input.
      additionalProperties: false
    OrganizationRoleAssignment:
      oneOf:
        - $ref: '#/components/schemas/OrganizationPredefinedRoleAssignment'
        - $ref: '#/components/schemas/OrganizationCustomRoleAssignment'
      discriminator:
        propertyName: type
        mapping:
          PREDEFINED:
            $ref: '#/components/schemas/OrganizationPredefinedRoleAssignment'
          CUSTOM:
            $ref: '#/components/schemas/OrganizationCustomRoleAssignment'
      description: >
        A role assignment for an organization membership. Discriminated by
        `type`:

        - `PREDEFINED`: one of the predefined roles (`ADMIN`, `MEMBER`,
        `READ_ONLY`, `ANNOTATOR`)

        - `CUSTOM`: a custom RBAC role identified by its ID
    ServiceKeySpaceAssignment:
      type: object
      description: >
        Declares one space that the service key's service account should have
        access to.


        The **space assignment** (`space_id`) identifies the target space. The
        **role assignment** (`role`)

        specifies the level of access within that space — either a named
        predefined role or a

        custom RBAC role identified by its ID.
      required:
        - space_id
      properties:
        space_id:
          type: string
          description: ID of the space to grant the service account access to.
          example: U3BhY2U6MjAwMTphQmNE
        role:
          allOf:
            - $ref: '#/components/schemas/SpaceRoleAssignment'
          default:
            type: PREDEFINED
            name: MEMBER
          description: >
            Role to assign the bot user within this space. A role assignment is
            either:

            - `{ "type": "PREDEFINED", "name": "ADMIN" | "MEMBER" | "READ_ONLY"
            }` — a built-in space role

            - `{ "type": "CUSTOM", "id": "<encoded-role-id>" }` — a custom RBAC
            role


            Defaults to `{ "type": "PREDEFINED", "name": "MEMBER" }` when
            omitted.

            Must be at or below the caller's own effective space role.

            The `ANNOTATOR` role is not valid for service keys and returns
            `422`.
      additionalProperties: false
    ApiKeyStatus:
      type: string
      enum:
        - ACTIVE
        - REVOKED
      description: |
        Current status of the API key.
        - ACTIVE - The key is valid for use.
        - REVOKED - The key has been revoked and is no longer valid.
    ServiceKeyBotUserOrgAssignment:
      type: object
      required:
        - org_id
        - role
        - spaces
      properties:
        org_id:
          type: string
          description: ID of the organization the service account has access to.
          example: T3JnYW5pemF0aW9uOjEwMDE6eFl6Vw
        role:
          allOf:
            - $ref: '#/components/schemas/OrganizationRoleAssignment'
          description: >-
            Role assigned to the bot user within this organization. Always
            present — defaults are resolved server-side.
        spaces:
          type: array
          items:
            $ref: '#/components/schemas/ServiceKeyBotUserSpaceAssignment'
          description: >-
            Space assignments within this organization. Roles are always present
            in the response (defaults are resolved server-side).
      additionalProperties: false
    UserRoleAssignmentType:
      type: string
      enum:
        - PREDEFINED
        - CUSTOM
    UserRole:
      type: string
      enum:
        - ADMIN
        - MEMBER
        - ANNOTATOR
      description: Account-level role of the user. These are pre-defined roles in Arize.
    Id:
      type: string
      description: A universally unique identifier (base64-encoded opaque string).
      example: RW50aXR5OjEyMzQ1
    OrganizationPredefinedRoleAssignment:
      type: object
      description: A predefined organization role assignment.
      required:
        - type
        - name
      properties:
        type:
          allOf:
            - $ref: '#/components/schemas/OrganizationRoleAssignmentType'
          default: PREDEFINED
          description: >-
            Discriminator identifying this as a predefined role assignment.
            Always `PREDEFINED` for this variant.
        name:
          $ref: '#/components/schemas/OrganizationRole'
      additionalProperties: false
    OrganizationCustomRoleAssignment:
      type: object
      description: A custom RBAC role assignment.
      required:
        - type
        - id
      properties:
        type:
          allOf:
            - $ref: '#/components/schemas/OrganizationRoleAssignmentType'
          default: CUSTOM
          description: >-
            Discriminator identifying this as a custom RBAC role assignment.
            Always `CUSTOM` for this variant.
        id:
          allOf:
            - $ref: '#/components/schemas/Id'
          description: The unique identifier of the custom RBAC role.
        name:
          type: string
          readOnly: true
          description: |
            Human-readable name of the custom role.
            Returned in responses only; ignored on input.
      additionalProperties: false
    SpaceRoleAssignment:
      oneOf:
        - $ref: '#/components/schemas/PredefinedRoleAssignment'
        - $ref: '#/components/schemas/CustomRoleAssignment'
      discriminator:
        propertyName: type
        mapping:
          PREDEFINED:
            $ref: '#/components/schemas/PredefinedRoleAssignment'
          CUSTOM:
            $ref: '#/components/schemas/CustomRoleAssignment'
      description: >
        Specifies which role to assign within a space. Discriminated by `type`:

        - `PREDEFINED`: a built-in platform role — `{ "type": "PREDEFINED",
        "name": "ADMIN" | "MEMBER" | "READ_ONLY" | "ANNOTATOR" }`

        - `CUSTOM`: a custom RBAC role identified by its ID — `{ "type":
        "CUSTOM", "id": "<encoded-role-id>" }`


        Used wherever a space-level role assignment is required (memberships,
        service key bindings, etc.).
    ServiceKeyBotUserSpaceAssignment:
      type: object
      required:
        - space_id
        - role
      properties:
        space_id:
          type: string
          description: ID of the space the service account has access to.
          example: U3BhY2U6MjAwMTphQmNE
        role:
          allOf:
            - $ref: '#/components/schemas/SpaceRoleAssignment'
          description: >-
            Role assigned to the bot user within this space. Always present —
            defaults are resolved server-side.
      additionalProperties: false
    OrganizationRoleAssignmentType:
      type: string
      enum:
        - PREDEFINED
        - CUSTOM
    OrganizationRole:
      type: string
      enum:
        - ADMIN
        - MEMBER
        - READ_ONLY
        - ANNOTATOR
      description: |
        Organization-level role for the user.
        - `ADMIN`: Full access to the organization and its resources.
        - `MEMBER`: Standard access to the organization.
        - `READ_ONLY`: Read-only access to the organization.
        - `ANNOTATOR`: Limited access for annotation tasks only.
    PredefinedRoleAssignment:
      type: object
      description: A predefined space role assignment.
      required:
        - type
        - name
      properties:
        type:
          allOf:
            - $ref: '#/components/schemas/SpaceRoleAssignmentType'
          default: PREDEFINED
          description: >-
            Discriminator identifying this as a predefined role assignment. Must
            be `PREDEFINED`.
        name:
          $ref: '#/components/schemas/UserSpaceRole'
      additionalProperties: false
    CustomRoleAssignment:
      type: object
      description: A custom RBAC role assignment.
      required:
        - type
        - id
      properties:
        type:
          allOf:
            - $ref: '#/components/schemas/SpaceRoleAssignmentType'
          default: CUSTOM
          description: >-
            Discriminator identifying this as a custom RBAC role assignment.
            Must be `CUSTOM`.
        id:
          allOf:
            - $ref: '#/components/schemas/Id'
          description: The unique identifier of the custom RBAC role.
        name:
          type: string
          readOnly: true
          description: |
            Human-readable name of the custom role.
            Returned in responses only; ignored on input.
      additionalProperties: false
    SpaceRoleAssignmentType:
      type: string
      enum:
        - PREDEFINED
        - CUSTOM
    UserSpaceRole:
      type: string
      enum:
        - ADMIN
        - MEMBER
        - READ_ONLY
        - ANNOTATOR
      description: |
        Space-level role for the user.
        - `ADMIN`: Full access to the space and its resources.
        - `MEMBER`: Standard access to the space.
        - `READ_ONLY`: Read-only access to the space.
        - `ANNOTATOR`: Limited access for annotation tasks only.
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: <api-key>
      description: >
        Most Arize AI endpoints require authentication. For those endpoints that
        require authentication, include your API key in the request header using
        the format

        ``` Authorization: Bearer <api-key>

        ```

````