feat(api-keys): enforce scoped API key permissions (#1038)

Stainless-Generated-From: f48749e

Author: stlc-bot

src/context/dev/types/monitor_create_response.py

@@ -253,10 +253,11 @@ class Webhook(BaseModel):
     secret: Optional[str] = None
     """Signing secret used to verify webhook authenticity.
 
-    Each delivery includes an `X-Context-Signature: t=<unix>,v1=<hmac>` header,
-    where the HMAC is SHA-256 over `"{t}.{rawRequestBody}"` keyed by this secret.
-    Recompute it with a constant-time compare and reject stale timestamps to prevent
-    replay. Generated by the API; cannot be set by clients.
+    Omitted unless the API key has monitors:write permission or full access. Each
+    delivery includes an `X-Context-Signature: t=<unix>,v1=<hmac>` header, where the
+    HMAC is SHA-256 over `"{t}.{rawRequestBody}"` keyed by this secret. Recompute it
+    with a constant-time compare and reject stale timestamps to prevent replay.
+    Generated by the API; cannot be set by clients.
     """
 
 

src/context/dev/types/monitor_list_response.py

@@ -254,10 +254,11 @@ class DataWebhook(BaseModel):
     secret: Optional[str] = None
     """Signing secret used to verify webhook authenticity.
 
-    Each delivery includes an `X-Context-Signature: t=<unix>,v1=<hmac>` header,
-    where the HMAC is SHA-256 over `"{t}.{rawRequestBody}"` keyed by this secret.
-    Recompute it with a constant-time compare and reject stale timestamps to prevent
-    replay. Generated by the API; cannot be set by clients.
+    Omitted unless the API key has monitors:write permission or full access. Each
+    delivery includes an `X-Context-Signature: t=<unix>,v1=<hmac>` header, where the
+    HMAC is SHA-256 over `"{t}.{rawRequestBody}"` keyed by this secret. Recompute it
+    with a constant-time compare and reject stale timestamps to prevent replay.
+    Generated by the API; cannot be set by clients.
     """
 
 

src/context/dev/types/monitor_retrieve_response.py

@@ -253,10 +253,11 @@ class Webhook(BaseModel):
     secret: Optional[str] = None
     """Signing secret used to verify webhook authenticity.
 
-    Each delivery includes an `X-Context-Signature: t=<unix>,v1=<hmac>` header,
-    where the HMAC is SHA-256 over `"{t}.{rawRequestBody}"` keyed by this secret.
-    Recompute it with a constant-time compare and reject stale timestamps to prevent
-    replay. Generated by the API; cannot be set by clients.
+    Omitted unless the API key has monitors:write permission or full access. Each
+    delivery includes an `X-Context-Signature: t=<unix>,v1=<hmac>` header, where the
+    HMAC is SHA-256 over `"{t}.{rawRequestBody}"` keyed by this secret. Recompute it
+    with a constant-time compare and reject stale timestamps to prevent replay.
+    Generated by the API; cannot be set by clients.
     """
 
 

src/context/dev/types/monitor_update_response.py

@@ -253,10 +253,11 @@ class Webhook(BaseModel):
     secret: Optional[str] = None
     """Signing secret used to verify webhook authenticity.
 
-    Each delivery includes an `X-Context-Signature: t=<unix>,v1=<hmac>` header,
-    where the HMAC is SHA-256 over `"{t}.{rawRequestBody}"` keyed by this secret.
-    Recompute it with a constant-time compare and reject stale timestamps to prevent
-    replay. Generated by the API; cannot be set by clients.
+    Omitted unless the API key has monitors:write permission or full access. Each
+    delivery includes an `X-Context-Signature: t=<unix>,v1=<hmac>` header, where the
+    HMAC is SHA-256 over `"{t}.{rawRequestBody}"` keyed by this secret. Recompute it
+    with a constant-time compare and reject stale timestamps to prevent replay.
+    Generated by the API; cannot be set by clients.
     """