API keys

Credentials that let your software act on your organization's behalf.

4 endpoints · base URL https://api.aerscheduler.com

get/apiKeys

List your API keys

Every key in your organization, with its roles, when it was last used, and whether it is active, expired, or revoked.

Secrets are not included and cannot be: only a hash is stored, so a key that has been lost has to be revoked and replaced.

Query parameters

`limit`	`integer`	Rows to return, 1–1000. Defaults to 1000; a larger value is clamped rather than rejected.
`offset`	`integer`	Rows to skip, for paging. Defaults to 0.

Responses

`200`	OK	The keys.→ { data: ApiKey[] }
`401`	Unauthorized	No token, an expired token, or a malformed one. Sign in again.
`403`	Forbidden	Authenticated, but not allowed to do this.
`429`	Too Many Requests	Rate limited. `Retry-After` says how long to wait.

Example request

curl https://api.aerscheduler.com/apiKeys \
  -H "Authorization: Bearer $AERSCHEDULER_TOKEN"

post/apiKeys

Create an API key

Mints a key and returns the secret once. Store it immediately — it is hashed on our side and this is the only response that will ever contain it.

The roles you assign are real: the key behaves like a member holding exactly those roles, and every permission rule that applies to a person applies to it. Give it the least it needs — a key that only reads schedules should be dispatcher, not admin.

Requires the admin role, and requires a signed-in session: a key cannot mint another key, so a leaked key cannot be used to issue itself replacements.

Request body

The key to create.

`name`required	`string`	How you'll recognise it in the list.
`roles`required	`"admin" \| "dispatcher" \| "instructor" \| "student" \| "renter" \| "technician"[]`	Roles the key acts with. At least one. `owner` cannot be granted to a key.
`expiresAt`	`string`	Optional expiry. A key with a deliberate lifetime is a better key.

Responses

`201`	Created	The key. `secret` appears here and nowhere else, ever.→ { data: ApiKeyWithSecret }
`400`	Bad Request	No name, no roles, an unknown role, or an expiry in the past.
`401`	Unauthorized	No token, an expired token, or a malformed one. Sign in again.
`403`	Forbidden	Authenticated, but not allowed to do this.
`429`	Too Many Requests	Rate limited. `Retry-After` says how long to wait.

Example request

curl -X POST https://api.aerscheduler.com/apiKeys \
  -H "Authorization: Bearer $AERSCHEDULER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name":"Zapier sync","roles":["dispatcher"]}'

delete/apiKeys/{apiKeyId}

Revoke an API key

Takes effect on the next request — there is no cache to wait out. The key stays in the list marked revoked rather than disappearing, so anything it created still has something to point at.

Requires the admin role and a signed-in session.

Path parameters

apiKeyIdrequired integer The key id. Not the secret.

Responses

`204`	No Content	Success. No body.
`401`	Unauthorized	No token, an expired token, or a malformed one. Sign in again.
`403`	Forbidden	Authenticated, but not allowed to do this.
`404`	Not Found	No such key in your organization.
`429`	Too Many Requests	Rate limited. `Retry-After` says how long to wait.

Example request

curl -X DELETE https://api.aerscheduler.com/apiKeys/:apiKeyId \
  -H "Authorization: Bearer $AERSCHEDULER_TOKEN"

get/apiKeys/roles

List grantable roles

The roles a key may be given, so a UI doesn't have to hardcode them.

Responses

`200`	OK	The grantable roles.→ { data: "admin" \| "dispatcher" \| "instructor" \| "student" \| "renter" \| "technician"[] }
`401`	Unauthorized	No token, an expired token, or a malformed one. Sign in again.
`403`	Forbidden	Authenticated, but not allowed to do this.
`429`	Too Many Requests	Rate limited. `Retry-After` says how long to wait.

Example request

curl https://api.aerscheduler.com/apiKeys/roles \
  -H "Authorization: Bearer $AERSCHEDULER_TOKEN"

NextOrganizationsThe flight school itself: membership, invitations, and settings.

All areas

API overview Talk to us