fix: remove machine access to key and project token management

README.md

@@ -278,13 +278,11 @@ project clients see only their project.
 The organization view also exposes these management resources:
 
 - `organizations`: retrieve the organization visible to the API key
-- `apiKeys`: list key metadata and deactivate an organization API key
 - `members`: list organization members
 - `auditLogs`: list the organization audit trail with live action, resource,
   and limit filters
 - `sessionBans`: list all or active session bans
 - `securityIncidents`: list and acknowledge leaked-credential incidents
-- `projectTokens`: list token metadata for an explicit project
 - `sipTrunks`: list, create, retrieve, update, delete, and rotate the
   credentials of a project's SIP trunks, and read the SIP address your PBX
   points at with `endpoint()` (also on project clients)
@@ -962,3 +960,7 @@ quiet gaps, duration sums, sample counts and weighted averages. Ranges up to
 48 hours use hourly activity buckets; longer ranges and call series use daily
 UTC buckets. These signals do not establish phone online/offline or power state.
 See the [measurement definitions](https://docs.polymorfa.com/console/analytics#phone-polymorfa-and-customer-activity).
+
+Organization keys and project tokens are created, listed and revoked by a signed-in
+person in the Console. The SDK exposes client-token operations only; machine
+credentials cannot manage organization keys or project tokens.

contracts/README.md

@@ -1,3 +1,11 @@
+## Human-only credential-management supplement
+
+The Platform snapshot removes GET /platform/keys, DELETE /platform/keys/{keyId}
+and GET /platform/tokens. The full baseline remains recorded below; the exact
+removal source revision is recorded in credential-management.json. No unrelated
+contract parity or registry availability is implied. Signed-in Console people
+manage organization keys and project tokens. Client-token operations remain.
+
 # Contract coverage
 
 ## Message provider references
@@ -41,7 +49,7 @@ published SDK package before updating their pinned dependency.
 
 ## Full snapshots
 
-The current snapshots are byte-identical copies of the Messaging and Platform
+The baseline snapshots are byte-identical copies of the Messaging and Platform
 contracts at API dev merge commit `e3d1d2dbc8287f79daf0a1d6f6f5375c1a9d9dbb`
 (after polymorfa/polymorfa#330, #328, #335, #382, #408, #494, #482 and #488).
 Campaign create, update and launch types add template variable mappings,
@@ -50,8 +58,8 @@ add sequence progress; webhooks add `campaign.recipient_link_opened` and
 `messageIndex`. Fourteen new Campaigns operations (test send, audience profiles and imports, link reports, campaign
 settings and approval reads) are recorded as
 missing until their methods follow. The three approval decisions and the
-threshold update are console routes and are excluded. The ledger contains 608
-operations: 454 covered, 0 partial, 14 missing and 140 excluded.
+threshold update are console routes and are excluded. The ledger after the human-only credential-management removal contains 605
+operations: 451 covered, 0 partial, 14 missing and 140 excluded.
 
 The previous snapshots were byte-identical copies of the Messaging and Platform
 contracts at API dev merge commit `ff12a76fe44fa23bf71e00fc6454a51b1fdbb399`

contracts/coverage.json

@@ -2778,17 +2778,6 @@
         "method": "Client.project(projectId).functions.secrets.revoke"
       }
     },
-    {
-      "family": "platform",
-      "method": "DELETE",
-      "path": "/platform/keys/{keyId}",
-      "operationId": "deactivateApiKey",
-      "fingerprint": "3bc6580c15162209c02f62d80fce46f3860eeaeab4cdcf762462575611403286",
-      "typescript": {
-        "status": "covered",
-        "method": "Client.apiKeys.deactivate"
-      }
-    },
     {
       "family": "platform",
       "method": "DELETE",
@@ -3352,7 +3341,7 @@
       },
       "sourceContractSha256": "97fd5ca378699350c53412267a39ef66cc64111283c7bfd155fa932d77bf925b",
       "sourceCommit": "e3d1d2dbc8287f79daf0a1d6f6f5375c1a9d9dbb",
-      "sdkContractSha256": "97fd5ca378699350c53412267a39ef66cc64111283c7bfd155fa932d77bf925b"
+      "sdkContractSha256": "dc3c6ddde8280f9d508d725af6c9413aeb089445cdd6677f9774ec994ca6e926"
     },
     {
       "family": "platform",
@@ -3365,7 +3354,7 @@
       },
       "fingerprint": "e999dce00d84dd7b4d40958ea76527c37c27fc867fa7ccf5f9f4e713c1f12555",
       "sourceContractSha256": "97fd5ca378699350c53412267a39ef66cc64111283c7bfd155fa932d77bf925b",
-      "sdkContractSha256": "97fd5ca378699350c53412267a39ef66cc64111283c7bfd155fa932d77bf925b",
+      "sdkContractSha256": "dc3c6ddde8280f9d508d725af6c9413aeb089445cdd6677f9774ec994ca6e926",
       "sourceCommit": "e3d1d2dbc8287f79daf0a1d6f6f5375c1a9d9dbb"
     },
     {
@@ -4145,17 +4134,6 @@
         "method": "Client.securityIncidents.list"
       }
     },
-    {
-      "family": "platform",
-      "method": "GET",
-      "path": "/platform/keys",
-      "operationId": "listApiKeys",
-      "fingerprint": "9ee9f6dd215383112136a81a368df55ac054ef468daa9fd200a5824f27ad3b16",
-      "typescript": {
-        "status": "covered",
-        "method": "Client.apiKeys.list"
-      }
-    },
     {
       "family": "platform",
       "method": "GET",
@@ -4278,7 +4256,7 @@
       },
       "sourceContractSha256": "97fd5ca378699350c53412267a39ef66cc64111283c7bfd155fa932d77bf925b",
       "sourceCommit": "e3d1d2dbc8287f79daf0a1d6f6f5375c1a9d9dbb",
-      "sdkContractSha256": "97fd5ca378699350c53412267a39ef66cc64111283c7bfd155fa932d77bf925b"
+      "sdkContractSha256": "dc3c6ddde8280f9d508d725af6c9413aeb089445cdd6677f9774ec994ca6e926"
     },
     {
       "family": "platform",
@@ -4291,7 +4269,7 @@
       },
       "fingerprint": "240ac51bf9ba12d47624b0cd8ba96b018d1b2e0e7e7e4e8e4d8c3152025c4fab",
       "sourceContractSha256": "97fd5ca378699350c53412267a39ef66cc64111283c7bfd155fa932d77bf925b",
-      "sdkContractSha256": "97fd5ca378699350c53412267a39ef66cc64111283c7bfd155fa932d77bf925b",
+      "sdkContractSha256": "dc3c6ddde8280f9d508d725af6c9413aeb089445cdd6677f9774ec994ca6e926",
       "sourceCommit": "e3d1d2dbc8287f79daf0a1d6f6f5375c1a9d9dbb"
     },
     {
@@ -4670,17 +4648,6 @@
         "milestone": "credential-boundary"
       }
     },
-    {
-      "family": "platform",
-      "method": "GET",
-      "path": "/platform/tokens",
-      "operationId": "listPolymorfaTokens",
-      "fingerprint": "d8ab97e205775112f019858dee537c0b36a65987eb8d003b1681910572e50473",
-      "typescript": {
-        "status": "covered",
-        "method": "Client.projectTokens.list"
-      }
-    },
     {
       "family": "platform",
       "method": "GET",

contracts/credential-management.json

@@ -0,0 +1,27 @@
+{
+  "repository": "polymorfa/polymorfa",
+  "sourceCommit": "cdc3d8dd2770693f1d319ecf5d0fa1a058717a0d",
+  "sourcePath": "apps/api/docs/openapi.management.json",
+  "sourceContractSha256": "dd02c846c218772a62539781764726bc366ff6047597f9150112225022f65471",
+  "removedOperations": [
+    {
+      "method": "GET",
+      "path": "/platform/keys"
+    },
+    {
+      "method": "DELETE",
+      "path": "/platform/keys/{keyId}"
+    },
+    {
+      "method": "GET",
+      "path": "/platform/tokens"
+    }
+  ],
+  "retainedHumanRoutes": [
+    "/console/keys",
+    "/console/keys/{keyId}",
+    "/api/account/keys",
+    "/api/account/projects/{projectId}/tokens"
+  ],
+  "note": "Applies only this credential-management removal to the existing full baseline. Client-token operations are unchanged. This candidate does not assert unrelated API parity, publication or deployment."
+}