Team Directives and safe retries in the management API
Read the team's own Directives with any management key, and change them with one created with the new Team Directives permission. Creating keys, rotating them and adding webhooks take an Idempotency-Key, so a retried call never makes a second one.
GET and PATCH /v1/team/directives follow the console's team save: the same validation, a policy_version check that answers 409 version_conflict, the policy.update audit event, and the low-balance alert, which only the team level sets. Changing them needs a management key with Team Directives ticked when it is created, off by default: the team's Directives are the ceiling for every project, so a leaked key without the permission can't loosen it.
A retry with the same Idempotency-Key and body within 24 hours answers 409 result_not_replayable naming the key, rotation or endpoint the first call made (its secret was shown once and isn't kept); a different body answers 409 idempotency_conflict, as on the inference API.
Keys created or rotated through the API, and management keys, now get the same Better Auth record as keys made on the API Keys page. Project Directives in the console, the Auditor project's included, save through the same code as the API.
Rotating a key no longer restarts its own budget or its tag budgets: the new key spends from the same day and month as the old one, and spend during the overlap counts once.
More in Team Directives.