Admin API

The admin API lives at /v1/admin/* and requires session-cookie auth (or the MEMOTURN_DEV_SECRET bearer token for local dev). It’s the control surface for managing projects and API keys.

Projects

Create a project

curl -X POST https://YOUR_API_HOST/v1/admin/projects \
  -H "Authorization: Bearer $MEMOTURN_DEV_SECRET" \
  -H "Content-Type: application/json" \
  -d '{"slug": "my-project", "name": "My Project"}'

field	type	notes
slug	string	1–128 chars, alphanumeric + . _ : -. Must be unique within the org.
name	string?	Display name, max 256 chars. Defaults to the slug.
org_id	uuid?	Defaults to the session’s active org.

Returns 201 with the project object. Returns 409 if the slug is already taken.

List projects

curl https://YOUR_API_HOST/v1/admin/projects \
  -H "Authorization: Bearer $MEMOTURN_DEV_SECRET"

Returns { projects: [...] } scoped to the session’s active org.

API keys

API keys authenticate MCP and REST calls. Each key is scoped to a single project and stamped with the issuing user’s email (used as actor_email on every write).

Issue a key

curl -X POST https://YOUR_API_HOST/v1/admin/projects/my-project/keys \
  -H "Authorization: Bearer $MEMOTURN_DEV_SECRET" \
  -H "Content-Type: application/json" \
  -d '{"name": "cursor-dev"}'

field	type	notes
name	string?	Label, max 256 chars. Defaults to "unnamed key".
scopes	string[]?	Max 20 items. Defaults to ["*"]. Reserved for future fine-grained scoping.

The response includes the full API key (mt_...). This is the only time the key is returned — store it immediately.

List keys

curl https://YOUR_API_HOST/v1/admin/projects/my-project/keys \
  -H "Authorization: Bearer $MEMOTURN_DEV_SECRET"

Returns { keys: [...] } with metadata (name, scopes, created_at). Does not return the key value.

Revoke a key

curl -X DELETE https://YOUR_API_HOST/v1/admin/projects/my-project/keys/KEY_ID \
  -H "Authorization: Bearer $MEMOTURN_DEV_SECRET"

Returns { ok: true, revoked_at: number }. The KV lookup entry is also cleared so the key stops working immediately.