Workspace keys

A workspace key (moai_org_…) calls the Moon AI chat on behalf of a team workspace: the request runs in that workspace, with its models, its rules and its usage limit.

Available endpoints#Link to the Available endpoints section

A workspace key only reaches these paths, on https://chat.realmoon.ai:

Any other path returns 403 org_api_key_scope_forbidden. On the two Anthropic-format paths, the x-api-key header is accepted in place of Authorization: Bearer.

Send a message#Link to the Send a message section

POST /api/chat/completions

curl https://chat.realmoon.ai/api/chat/completions \
  -H "Authorization: Bearer $MOONAI_ORG_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "anthropic/claude-haiku-4.5",
    "messages": [{"role": "user", "content": "Résume la politique de congés en trois points."}],
    "stream": false
  }'

import os
import requests

r = requests.post(
    "https://chat.realmoon.ai/api/chat/completions",
    headers={"Authorization": f"Bearer {os.environ['MOONAI_ORG_KEY']}"},
    json={
        "model": "anthropic/claude-haiku-4.5",
        "messages": [{"role": "user", "content": "Résume la politique de congés en trois points."}],
        "stream": False,
    },
    timeout=120,
)
r.raise_for_status()
print(r.json()["choices"][0]["message"]["content"])

const r = await fetch('https://chat.realmoon.ai/api/chat/completions', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.MOONAI_ORG_KEY}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    model: 'anthropic/claude-haiku-4.5',
    messages: [{ role: 'user', content: 'Résume la politique de congés en trois points.' }],
    stream: false,
  }),
});
if (!r.ok) throw new Error(await r.text());
const data = await r.json();
console.log(data.choices[0].message.content);

The response follows the OpenAI format: choices[0].message.content holds the text.

On whose behalf#Link to the On whose behalf section

• The key acts on behalf of the person who created it, with the member role, never with admin rights.
• It stays tied to the key’s workspace, whatever workspace that person has open in the app.
• Usage counts toward that person’s limit in that workspace.

What the key does not use#Link to the What the key does not use section

So that a key can never read anything private, a request made with it:

• has no attached files, no tools and no tool servers;
• uses neither the person’s memory, nor their connectors, nor their folders;
• only picks from the platform’s public models and the models shared with the workspace, never one of the person’s private models or agents and never a direct connection (Model not found).

When the key stops working#Link to the When the key stops working section

Deleting the workspace also makes its keys unusable.

Manage keys#Link to the Manage keys section

These routes are called with the session of a workspace owner or admin signed in to Moon AI, never with a key.

Create a key#Link to the Create a key section

POST /api/v1/organizations/{org_id}/api-keys

{
  "id": "6a5b4c3d-2e1f-4a0b-9c8d-7e6f5a4b3c2d",
  "org_id": "8c1f2a4e-5b6d-4e7f-9a0b-1c2d3e4f5a6b",
  "name": "Intranet",
  "key": "moai_org_…",
  "key_prefix": "moai_org_3f9a",
  "expires_at": 1801296000,
  "created_at": 1793520000
}

The full key (key) is only returned in this response.

List keys#Link to the List keys section

GET /api/v1/organizations/{org_id}/api-keys

Returns the keys that are not revoked, without their value:

[
  {
    "id": "6a5b4c3d-2e1f-4a0b-9c8d-7e6f5a4b3c2d",
    "org_id": "8c1f2a4e-5b6d-4e7f-9a0b-1c2d3e4f5a6b",
    "name": "Intranet",
    "key_prefix": "moai_org_3f9a",
    "created_by": "3f2b9c1d-7e4a-4b8c-9d0e-1f2a3b4c5d6e",
    "last_used_at": 1793606400,
    "expires_at": 1801296000,
    "revoked_at": null,
    "created_at": 1793520000,
    "updated_at": 1793520000
  }
]

Revoke a key#Link to the Revoke a key section

DELETE /api/v1/organizations/{org_id}/api-keys/{key_id}

Returns {"success": true}, or 404 if the key does not exist in this workspace. Revocation is permanent.

Every creation and every revocation is recorded in the organization’s audit log.