# Organization admin API keys

Create an organization admin key in **Settings**, on the **General** tab, under **Admin API keys**. Only organization administrators can create or revoke these keys. Choose a name and an expiry of 30 days, 90 days, or one year. The secret is shown once. Copy it to your secret manager and confirm that you have
stored it before closing the creation dialog.

These credentials are separate from project API keys. They cannot scan, generate completions, read scan results, or access another organization. They follow the creator's current admin access and stop working when revoked, expired, or when the organization is suspended. Suspension revokes existing admin keys permanently.

## Supported operations

- Read your organization's metadata.
- List and create projects in your organization.
- Read and update your projects, publish controls, and manage project API keys.

Organization creation, listing all organizations, and organization suspension are platform-operator operations. An organization admin key cannot use them. Manage billing and membership in the console.

```sh
curl 'https://api.zaun.ai/v1/admin/organizations/YOUR_ORGANIZATION_ID/projects' \
  -H "Authorization: Bearer $ZAUN_ORG_ADMIN_KEY"
```

Store the key in your secret manager and revoke it from the **General** tab in **Settings** when no longer needed. Use a project key from **API keys** for scan and completion requests.

## Find, rotate and revoke keys

Search by key name or prefix. The list shows each key’s status, creation date and
expiry date. Enable **Show expired and revoked** to include inactive keys among
the 100 most recent records.

To rotate a key, create a replacement, update your integration and verify it works,
then select **Revoke** on the old key. Type the key’s name to confirm. Revocation
stops authorization immediately and cannot be undone. The revoked record remains
visible in history; the secret cannot be recovered.

The **General** tab in **Settings** has three tabs of its own: **General**, **Data privacy**,
and **Admin API keys**.
The no-training preference lives in Data privacy and stays enabled by default.