Summary

A global admin should see and edit every API key in the instance, not only their own. Deleting a key is replaced by archiving, so the key stays on the list. The list gets owner and status columns with matching filters, the limit of 20 keys per user is removed, and every key gains a usage log and a configuration history, following how External Share does it.

Acceptance criteria

1. A global admin sees and edits every API key in the instance, regardless of who created it.

2. The "Delete" action is replaced by "Archive". An archived key stays on the list, cannot be edited, and stops authenticating API calls.

3. New "Status" column and filter: Scheduled / Active / Expired / Archived. The filter also offers "All" and defaults to "Active".

4. New "Owner" column and filter showing the creator's display name, not the account ID. The filter offers "All" plus every user who created a key in the instance.

5. Filters and sorting apply to the whole set of keys, and the results count and pagination reflect the filtered result.

6. The limit of 20 keys per user is removed.

7. Every Web API call records key usage (time, IP, request dump), visible per key as "Api Key Usage". Entries older than 7 days are removed by a cron job.

8. Every change to a key (creation, edit, archiving) creates a new configuration version with its author, time and IP. The list shows the newest version, and a "View Configuration History" screen shows all of them.

9. Statuses and the expired-date highlight are readable in dark mode.

10. Editing someone else's key never reveals its value.

How External Share does it (details in the code)

• Usage log: the api_key_usage table (api_key_id, time, remote_ip, usage jsonb), written by ApiKeyService.registerKeyUsage called from WebApiController after authentication, read through GET api/keys/usage/{id}, and pruned by ApiKeyUsageCleanupService (cron at 1:00, 7-day retention).

• Configuration history: versioned api_key_config rows (created_by_id, remote_ip, creation_time, privileges, validity dates, allowed_ips, archived). The list reads the newest version, GET api/keys/history/{id} returns all of them, and archiving is a new version with archived = true.

Out of scope

• Restoring an archived key (Unarchive) and permanently deleting keys.

• "Created" and "Last used" columns.

• Filtering by name or description.

• Exporting the list: AP-962.