Create API key (returns raw key once)

POST

/v1/api-keys

curl --request POST \
  --url https://example.com/v1/api-keys \
  --header 'Content-Type: application/json' \
  --header 'X-API-Key: <X-API-Key>' \
  --header 'X-Tenant-ID: 2489E9AD-2EE2-8E00-8EC9-32D5F69181C0' \
  --data '{ "name": "example", "scopes": [ "example" ], "expires_at": "2026-04-15T12:00:00Z", "identity_provider_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0" }'

Authorizations

• ApiKeyAuth
• BearerAuth

Parameters

Header Parameters

X-Tenant-ID

required

string format: uuid

Tenant identifier. Must match the tenant associated with the credential. Returns 403 tenant_mismatch if the credential and header belong to different tenants.

Request Body ^required

Media type application/json

object

name

required

string

scopes

Array<string>

expires_at

string format: date-time

nullable

identity_provider_id

Links this API key to a specific identity provider (used for SCIM tokens).

string format: uuid

nullable

Example ^generated

{
  "name": "example",
  "scopes": [
    "example"
  ],
  "expires_at": "2026-04-15T12:00:00Z",
  "identity_provider_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0"
}

Responses

201

Created. The raw_key field is only present in this response.

Media type application/json

object

id

required

string format: uuid

name

required

string

scopes

required

Array<string>

created_by

User ID or email of the key creator.

string

nullable

last_used_at

string format: date-time

nullable

expires_at

string format: date-time

nullable

revoked_at

When the key was revoked. Null if active.

string format: date-time

nullable

revoked_by

User who revoked the key.

string

nullable

created_at

required

string format: date-time

identity_provider_id

Links this API key to a specific identity provider (used for SCIM tokens).

string format: uuid

nullable

raw_key

required

The plaintext API key. Shown only once at creation time.

string

Example ^generated

{
  "id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
  "name": "example",
  "scopes": [
    "example"
  ],
  "created_by": "example",
  "last_used_at": "2026-04-15T12:00:00Z",
  "expires_at": "2026-04-15T12:00:00Z",
  "revoked_at": "2026-04-15T12:00:00Z",
  "revoked_by": "example",
  "created_at": "2026-04-15T12:00:00Z",
  "identity_provider_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
  "raw_key": "example"
}

400

Invalid input

Media type application/json

object

code

required

Machine-readable error code (e.g. “not_found”, “tenant_mismatch”).

string

message

required

Human-readable description of the error.

string

details

Optional additional context about the error.

object

key

additional properties

any

notices

Policy notices from determining Cedar rules, if applicable.

Array<string>

Example ^generated

{
  "code": "example",
  "message": "example",
  "details": {},
  "notices": [
    "example"
  ]
}

401

Unauthenticated

Media type application/json

object

code

required

Machine-readable error code (e.g. “not_found”, “tenant_mismatch”).

string

message

required

Human-readable description of the error.

string

details

Optional additional context about the error.

object

key

additional properties

any

notices

Policy notices from determining Cedar rules, if applicable.

Array<string>

Example ^generated

{
  "code": "example",
  "message": "example",
  "details": {},
  "notices": [
    "example"
  ]
}

403

Forbidden

Media type application/json

object

code

required

Machine-readable error code (e.g. “not_found”, “tenant_mismatch”).

string

message

required

Human-readable description of the error.

string

details

Optional additional context about the error.

object

key

additional properties

any

notices

Policy notices from determining Cedar rules, if applicable.

Array<string>

Example ^generated

{
  "code": "example",
  "message": "example",
  "details": {},
  "notices": [
    "example"
  ]
}

404

Referenced identity_provider_id was not found

Media type application/json

object

code

required

Machine-readable error code (e.g. “not_found”, “tenant_mismatch”).

string

message

required

Human-readable description of the error.

string

details

Optional additional context about the error.

object

key

additional properties

any

notices

Policy notices from determining Cedar rules, if applicable.

Array<string>

Example ^generated

{
  "code": "example",
  "message": "example",
  "details": {},
  "notices": [
    "example"
  ]
}

422

Request fails a semantic constraint (e.g. SCIM scopes on an incapable provider type)

Media type application/json

object

code

required

Machine-readable error code (e.g. “not_found”, “tenant_mismatch”).

string

message

required

Human-readable description of the error.

string

details

Optional additional context about the error.

object

key

additional properties

any

notices

Policy notices from determining Cedar rules, if applicable.

Array<string>

Example ^generated

{
  "code": "example",
  "message": "example",
  "details": {},
  "notices": [
    "example"
  ]
}