API Credentials
3. API Keys
API Keys manages the programmatic access credentials used by agents to authenticate with the Theseus Guard enforcement API.
3.1 Tenant API Key
A single Tenant API Key provides administrative-level API access for backend integrations (e.g., SIEM connectors, CI/CD pipelines, data pipelines). Only one tenant key exists at a time.
The card displays: - Key name - Masked key preview (first and last characters only) - Rotate Key button — Invalidates the current tenant key and generates a new one. The new key is displayed once and must be copied immediately.
3.2 Agent API Keys
Agent API Keys are per-agent credentials that agents use to authenticate their requests to the enforcement API. Each key is scoped to a specific Agent DNA profile.
The table shows:
- Name — The agent profile this key belongs to
- Key Preview — Masked version of the key
- Status — ACTIVE or REVOKED
- Last Used — When this key was last used to make a request
- Date — When the key was created
- Actions — Reveal, Rotate, Revoke buttons
3.3 Create a New Agent Key
Clicking Create New Agent Key opens a modal: - Agent DNA Profile — Select which agent profile this key will authenticate - Key Name — A descriptive label for the key (e.g., "Production Agent Key")
Upon creation, the full raw API key is displayed once in a copy modal. After dismissal, only the masked version is accessible. This key cannot be retrieved again — if lost, it must be rotated.
3.4 Key Operations
- Reveal — Shows the partial masked format (first 5 and last 5 characters visible)
- Rotate — Immediately invalidates the current key and generates a new one. The new key is displayed once for copying
- Revoke — Permanently disables the key. This action cannot be undone
4. Audit Logs
Audit Logs provides full transparency into all administrative and governance actions performed within the Theseus Guard platform. Every action taken by a user or the system is recorded as an immutable log entry.
4.1 Log Table
| Column | Description |
|---|---|
| Category | The domain of the action (AUTH, POLICY, INTEGRATION, GROUPS, SECRETS) |
| Action | A specific action identifier (e.g., user.invite, policy.approve, key.rotate) |
| Actor | Email address of the user who performed the action, or System for automated actions |
| Summary | A human-readable description of what was done |
| Date | Timestamp of the action |
4.2 Filters
- Category — Filter by action domain: Authentication, Policies, Integrations, Groups, Secrets
- Time Range — Last 24 hours, Last 7 days, or Last 30 days