Per-organisation API keys with default scopes

Two related housekeeping changes around API keys land this week. Neither is glamorous; both are overdue.

What's new

• Default key per organisation. Every organisation now provisions a default API key automatically, with a fixed and sensible set of scopes (read access across the standard surfaces, plus agent:search so the new persona library search works out of the box). Replaces the pattern where new orgs hit a 403 on their first call because no key existed yet.

• Default-scope reconciliation on rotation. When a key is revoked or marked stale, the next key minted for the org inherits the canonical default scopes — so you don't end up with a half-scoped replacement after a rotation.

• Multi-tenant routing. The MCP layer now resolves the calling organisation per-request via headers, with explicit organization_id injection on the way through. No more cross-tenant ambiguity when one process calls on behalf of multiple orgs.

What this changes for existing keys

Nothing — existing keys keep their existing scopes. The default-scope behaviour applies to newly provisioned keys (including post-rotation replacements). Anything explicitly scoped beyond the default stays scoped beyond the default.

Why now

The new persona library search (GET /v1/agents/search, shipped last week) needed agent:search in the default scope set so existing customers wouldn't have to call support to use it. That dependency forced the cleanup, which was overdue regardless.

Full reference is in the API docs.

---