cmind/apikey/v2/internal_api_key_service.proto
Package: cmind.apikey.v2
Services
InternalApiKeyService
InternalApiKeyService exposes operations callable only by other in-cluster services over mTLS. Reachable solely via the per-caller AuthorizationPolicy generated from cm-service's internalClients values; not routed via the API ingress. The (cmind.authz.internal_service) option opts the handler out of the passport-principal requirement: callers are authenticated by the mTLS peer SA, not by a JWT.
ImportApiKey
ImportApiKey registers a pre-existing service-account API key for the v1 → v2 legacy migration. Mirrors the deprecated public ApiKeyService.ImportApiKey but without grant checks: the only legitimate caller is the model-endpoint migration job, which has no passport identity and shouldn't synthesize one.
Request: ImportApiKeyRequest
Response: ImportApiKeyResponse