import { ClientSDK, RequestOptions } from "../lib/sdks.js";
import * as components from "../models/components/index.js";
import * as operations from "../models/operations/index.js";
export declare class ApiKeys extends ClientSDK {
    /**
     * List API keys
     *
     * @remarks
     * Returns API keys visible to the current workspace, ordered by creation time with the newest key first. The `api_key` and `token_hash` fields are never returned by this endpoint; only `token_prefix` is included.
     */
    list(request?: operations.ApiKeyListRequest | undefined, options?: RequestOptions): Promise<components.ListApiKeysResponse>;
    /**
     * Create a new API key
     *
     * @remarks
     * Mints a new opaque API key (`sk-orq-<key_id>-<secret>`) in the workspace. The raw secret is returned ONCE in the response and is never retrievable afterwards. The stored record retains only `token_prefix` and a SHA-256 `token_hash`.
     */
    create(request: components.CreateApiKeyRequest, options?: RequestOptions): Promise<components.CreateApiKeyResponse>;
    /**
     * List capability catalog
     *
     * @remarks
     * Returns the capability catalog: the set of permission domains that can be granted to an API key. Each entry includes the domain id, display name, group, allowed project scopes, and the read / write verb sets resolved at authorize() time. Drives the permissions UI in the dashboard.
     */
    listCapabilities(options?: RequestOptions): Promise<components.ListCapabilitiesResponse>;
    /**
     * Retrieve an API key
     *
     * @remarks
     * Retrieves the metadata for an existing API key by its unique identifier. The raw secret is never returned — only `token_prefix`, `permission_mode`, `project_scope`, and lifecycle fields.
     */
    get(request: operations.ApiKeyGetRequest, options?: RequestOptions): Promise<components.GetApiKeyResponse>;
    /**
     * Delete an API key
     *
     * @remarks
     * Permanently deletes an API key. Cache entries in `API_KEYS_KV` are invalidated immediately so an in-flight token cannot ride out the TTL. The response body is empty on success.
     */
    delete(request: operations.ApiKeyDeleteRequest, options?: RequestOptions): Promise<components.DeleteApiKeyResponse>;
    /**
     * Update an API key
     *
     * @remarks
     * Updates mutable fields of an API key: display name, status (active / disabled / revoked), permission mode and access map, project scope, and constraints (budget / rate limit / expiry). Omitted fields keep their current values.
     */
    update(request: operations.ApiKeyUpdateRequest, options?: RequestOptions): Promise<components.UpdateApiKeyResponse>;
}
//# sourceMappingURL=apikeys.d.ts.map