OneSignal organization-key operations for safe app inventory and creation, audit logs, API-key metadata/update/revocation, and cross-app template copy. This leaf carries 7 of the suite's 51 executable operations. App creation accepts only non-secret scalar metadata through a closed schema; push-provider credentials are intentionally unavailable. Key creation and rotation and credential-bearing app reads/updates remain excluded because their successful JSON responses contain secrets. Every read is uncached and not approval-gated, and every mutation requires approval.