{
  "license": "CC BY 4.0",
  "recipe": {
    "slug": "api-key-lifecycle-audit",
    "title": "Audit API-Key Lifecycle Events",
    "testedWith": "Apache DataFusion 45.2.0",
    "lastReviewed": "2026-07-28"
  },
  "contract": {
    "tableName": "api_key_audit_events",
    "schema": [
      {
        "name": "timestamp_utc",
        "type": "Timestamp",
        "description": "Lifecycle event time."
      },
      {
        "name": "key_id",
        "type": "Utf8",
        "description": "Non-secret key record identifier."
      },
      {
        "name": "owner_type",
        "type": "Utf8",
        "description": "Service, user, or automation owner class."
      },
      {
        "name": "scope_class",
        "type": "Utf8",
        "description": "Bounded scope category."
      },
      {
        "name": "event_name",
        "type": "Utf8",
        "description": "key_created, key_used, key_rotated, or key_revoked."
      },
      {
        "name": "outcome",
        "type": "Utf8",
        "description": "success, denied, or failed."
      }
    ]
  },
  "query": "SELECT\n  key_id,\n  owner_type,\n  scope_class,\n  MIN(CASE WHEN event_name = 'key_created' THEN timestamp_utc END) AS created_at,\n  MAX(CASE WHEN event_name = 'key_used' THEN timestamp_utc END) AS last_used_at,\n  MAX(CASE WHEN event_name = 'key_rotated' THEN timestamp_utc END) AS rotated_at,\n  MAX(CASE WHEN event_name = 'key_revoked' THEN timestamp_utc END) AS revoked_at,\n  SUM(CASE WHEN outcome <> 'success' THEN 1 ELSE 0 END) AS failed_events\nFROM api_key_audit_events\nWHERE timestamp_utc >= now() - INTERVAL '90 days'\nGROUP BY key_id, owner_type, scope_class\nORDER BY created_at;",
  "fixtureKind": "schema-example",
  "inputRows": [
    {
      "timestamp_utc": "2026-07-28T10:00:00Z",
      "key_id": "key_id_example_1",
      "owner_type": "owner_type_example_1",
      "scope_class": "scope_class_example_1",
      "event_name": "workflow_completed",
      "outcome": "success"
    },
    {
      "timestamp_utc": "2026-07-28T11:00:00Z",
      "key_id": "key_id_example_2",
      "owner_type": "owner_type_example_2",
      "scope_class": "scope_class_example_2",
      "event_name": "workflow_completed",
      "outcome": "failed"
    },
    {
      "timestamp_utc": "2026-07-28T12:00:00Z",
      "key_id": "key_id_example_3",
      "owner_type": "owner_type_example_3",
      "scope_class": "scope_class_example_3",
      "event_name": "workflow_completed",
      "outcome": "success"
    }
  ],
  "illustrativeInputRows": [
    {
      "timestamp_utc": "2026-07-28T10:00:00Z",
      "key_id": "key_id_example_1",
      "owner_type": "owner_type_example_1",
      "scope_class": "scope_class_example_1",
      "event_name": "workflow_completed",
      "outcome": "success"
    },
    {
      "timestamp_utc": "2026-07-28T11:00:00Z",
      "key_id": "key_id_example_2",
      "owner_type": "owner_type_example_2",
      "scope_class": "scope_class_example_2",
      "event_name": "workflow_completed",
      "outcome": "failed"
    },
    {
      "timestamp_utc": "2026-07-28T12:00:00Z",
      "key_id": "key_id_example_3",
      "owner_type": "owner_type_example_3",
      "scope_class": "scope_class_example_3",
      "event_name": "workflow_completed",
      "outcome": "success"
    }
  ],
  "expectedOutput": {
    "columns": [
      "key_id",
      "owner_type",
      "scope_class",
      "created_at",
      "last_used_at",
      "rotated_at",
      "revoked_at",
      "failed_events"
    ],
    "rows": [
      {
        "key_id": "key-record-17",
        "owner_type": "automation",
        "scope_class": "read-write",
        "created_at": "2026-05-02",
        "last_used_at": "2026-07-28",
        "rotated_at": null,
        "revoked_at": null,
        "failed_events": 0
      },
      {
        "key_id": "key-record-42",
        "owner_type": "service",
        "scope_class": "write",
        "created_at": "2026-07-01",
        "last_used_at": "2026-07-26",
        "rotated_at": "2026-07-27",
        "revoked_at": "2026-07-27",
        "failed_events": 1
      }
    ]
  },
  "notes": [
    "The compact input rows demonstrate field names and JSON types; they are not claimed to generate the displayed aggregate by themselves.",
    "The expected output is deterministic synthetic review data for the documented output shape.",
    "Adapt time windows, thresholds, identities, and business definitions before operational use."
  ]
}