Previous value: -"Only with scope \"ingest\": binds the key to this one monitor (UUID from list_monitors), so it can send telemetry for that monitor and nothing else. Required for an exporter that cannot name its monitor, such as Codex."New value: +"Only with scope \"ingest\": binds the key to this one monitor (UUID from list_monitors), so it sends telemetry for that monitor alone. An exporter that cannot name its monitor, such as Codex, needs it."

Previous value: -"Optional RFC 3339 expiry, e.g. \"2026-12-31T00:00:00Z\". Omit for a 90-day key, capped at the creating key's own expiry. A key can never be given a longer life than the key that creates it."New value: +"Optional RFC 3339 expiry, e.g. \"2026-12-31T00:00:00Z\". Omitted: 90 days. Either way it is capped at the creating key's own expiry."

Previous value: -"What the new key may do. \"read\" is every GET; \"write\" is everything except managing API keys; \"admin\" is everything, key management included. Omit for \"write\", which is the right tier for a credential handed to a job or an agent: it can do the work and cannot mint itself a replacement. A key can never be given a HIGHER scope than the key that creates it; asking for one is refused and the refusal names the ceiling. \"ingest\" can only send pings and telemetry (traces, metrics, logs) and cannot call the REST API at all: use it for a key that lives in a dotfile or an exporter's config. This tool needs an admin key; with a write key, use create_ingest_key, which mints a tracing key bound to one monitor."New value: +"What the new key may do. \"read\" is every GET; \"write\" (the default) is everything except managing API keys, so a key at that tier cannot mint itself a replacement; \"admin\" is everything. A scope above the creating key's is refused, and the refusal names the ceiling. \"ingest\" only sends pings and telemetry (traces, metrics, logs) and cannot call the REST API, for a key kept in a dotfile or an exporter's config."

Added value: +{
+  "description": "Only with scope \"ingest\": binds the key to this one monitor (UUID from list_monitors), so it can send telemetry for that monitor and nothing else. Required for an exporter that cannot name its monitor, such as Codex.",
+  "type": "string"
+}

Previous value: -"What the new key may do. \"read\" is every GET; \"write\" is everything except managing API keys; \"admin\" is everything, key management included. Omit for \"write\", which is the right tier for a credential handed to a job or an agent: it can do the work and cannot mint itself a replacement. A key can never be given a HIGHER scope than the key that creates it; asking for one is refused and the refusal names the ceiling. \"ingest\" can only send pings and telemetry (traces, metrics, logs) and cannot call the REST API at all: use it for a key that lives in a dotfile or an exporter's config; minting one needs a write or admin key."New value: +"What the new key may do. \"read\" is every GET; \"write\" is everything except managing API keys; \"admin\" is everything, key management included. Omit for \"write\", which is the right tier for a credential handed to a job or an agent: it can do the work and cannot mint itself a replacement. A key can never be given a HIGHER scope than the key that creates it; asking for one is refused and the refusal names the ceiling. \"ingest\" can only send pings and telemetry (traces, metrics, logs) and cannot call the REST API at all: use it for a key that lives in a dotfile or an exporter's config. This tool needs an admin key; with a write key, use create_ingest_key, which mints a tracing key bound to one monitor."

Previous value: -"What the new key may do. \"read\" is every GET; \"write\" is everything except managing API keys; \"admin\" is everything, key management included. Omit for \"write\", which is the right tier for a credential handed to a job or an agent: it can do the work and cannot mint itself a replacement. A key can never be given a HIGHER scope than the key that creates it; asking for one is refused and the refusal names the ceiling."New value: +"What the new key may do. \"read\" is every GET; \"write\" is everything except managing API keys; \"admin\" is everything, key management included. Omit for \"write\", which is the right tier for a credential handed to a job or an agent: it can do the work and cannot mint itself a replacement. A key can never be given a HIGHER scope than the key that creates it; asking for one is refused and the refusal names the ceiling. \"ingest\" can only send pings and telemetry (traces, metrics, logs) and cannot call the REST API at all: use it for a key that lives in a dotfile or an exporter's config; minting one needs a write or admin key."

Previous value: -[
-  "read",
-  "write",
-  "admin"
-]New value: +[
+  "read",
+  "write",
+  "admin",
+  "ingest"
+]

Added value: +{
+  "description": "What the new key may do. \"read\" is every GET; \"write\" is everything except managing API keys; \"admin\" is everything, key management included. Omit for \"write\", which is the right tier for a credential handed to a job or an agent: it can do the work and cannot mint itself a replacement. A key can never be given a HIGHER scope than the key that creates it; asking for one is refused and the refusal names the ceiling.",
+  "enum": [
+    "read",
+    "write",
+    "admin"
+  ],
+  "type": "string"
+}

Previous value: -"Optional RFC 3339 expiry, e.g. \"2026-12-31T00:00:00Z\". Omit for a key that never expires."New value: +"Optional RFC 3339 expiry, e.g. \"2026-12-31T00:00:00Z\". Omit for a 90-day key, capped at the creating key's own expiry. A key can never be given a longer life than the key that creates it."