excel file update

app/api/schemas.py

@@ -63,6 +63,20 @@ class SourceProductOut(BaseModel):
 # Health
 # ---------------------------------------------------------------------------
 
+class ApiKeyInfoOut(BaseModel):
+    """One configured machine consumer, named but never quoted.
+
+    `fingerprint` is a truncated digest of name+secret, not the secret. It exists
+    so a caller who was issued a key can confirm THAT key is the one this
+    deployment loaded - the question a 401 cannot answer, since an undeployed key
+    and a wrong key fail identically.
+    """
+
+    name: str
+    role: str
+    fingerprint: str
+
+
 class AuthConfigOut(BaseModel):
     """
     The effective auth configuration, reported by /api/health.
@@ -73,7 +87,9 @@ class AuthConfigOut(BaseModel):
     already the documented one, allow_any_login=true is a fact an operator
     urgently needs (and an attacker discovers with a single login attempt
     anyway), and the fingerprint is a truncated hash of a salted digest, not a
-    password. What it buys is a one-command answer to "is this deployment
+    password. The API key block follows the same rule: it names which consumers
+    are configured and fingerprints their keys, so a caller can tell an
+    undeployed key from a rejected one, but it never renders a secret. What it buys is a one-command answer to "is this deployment
     running the config I think it is?" - compare the fingerprint here against
     the one printed by scripts/make_auth_secrets.py --fingerprint.
     """
@@ -87,6 +103,13 @@ class AuthConfigOut(BaseModel):
     # "process-env" | "env-file" | "default" - which one actually won.
     admin_username_source: str
     password_hash_source: str
+    # Machine consumers. Names and fingerprints only - the secrets themselves are
+    # never rendered here, and _parse_api_keys enforces enough entropy that the
+    # fingerprints do not give them away. Defaulted so a client of this schema
+    # still validates against a deployment predating these fields.
+    api_keys_count: int = 0
+    api_keys: List[ApiKeyInfoOut] = Field(default_factory=list)
+    api_keys_source: str = "default"
 
 
 class HealthOut(BaseModel):