import { ClientSDK, RequestOptions } from "../lib/sdks.js";
import * as components from "../models/components/index.js";
import * as operations from "../models/operations/index.js";
export declare class ManagementKeys extends ClientSDK {
    /**
     * List management keys
     *
     * @remarks
     * Returns management keys in the current workspace, ordered by creation time with the newest key first. The `api_key` and `token_hash` fields are never returned by this endpoint; only `token_prefix` is included.
     */
    list(request?: operations.ManagementKeyListRequest | undefined, options?: RequestOptions): Promise<components.ListManagementKeysResponse>;
    /**
     * Create a new management key
     *
     * @remarks
     * Mints a new opaque management key (`sk-orq-<key_id>-<secret>`) in the workspace. The raw secret is returned ONCE in the response and is never retrievable afterwards. The stored record retains only `token_prefix` and a SHA-256 `token_hash`.
     */
    create(request: components.CreateManagementKeyRequest, options?: RequestOptions): Promise<components.CreateManagementKeyResponse>;
    /**
     * List management capability catalog
     *
     * @remarks
     * Returns the management capability catalog: the set of workspace-admin permission domains that can be granted to a management key. Each entry includes the domain id, display name, group, and the read / write verb support. Drives the permissions UI in the dashboard.
     */
    listCapabilities(options?: RequestOptions): Promise<components.ListManagementCapabilitiesResponse>;
    /**
     * Retrieve a management key
     *
     * @remarks
     * Retrieves the metadata for an existing management key by its unique identifier. The raw secret is never returned — only `token_prefix`, `permission_mode`, and lifecycle fields.
     */
    get(request: operations.ManagementKeyGetRequest, options?: RequestOptions): Promise<components.GetManagementKeyResponse>;
    /**
     * Delete a management key
     *
     * @remarks
     * Permanently deletes a management key. Cache entries are invalidated immediately so an in-flight token cannot ride out the TTL. The response body is empty on success.
     */
    delete(request: operations.ManagementKeyDeleteRequest, options?: RequestOptions): Promise<components.DeleteManagementKeyResponse>;
    /**
     * Update a management key
     *
     * @remarks
     * Updates mutable fields of a management key: display name, status (active / disabled / revoked), permission mode and access map, and expiry. Omitted fields keep their current values.
     */
    update(request: operations.ManagementKeyUpdateRequest, options?: RequestOptions): Promise<components.UpdateManagementKeyResponse>;
}
//# sourceMappingURL=managementkeys.d.ts.map