iam.api_key.create

Create a narrow API key for this store: a named SERVICE actor plus its first token generation. Returns the raw token EXACTLY ONCE — it is never recoverable. Scopes are fenced subset-of-issuer (nobody grants what they do not hold). Expiry defaults to 90 days; “no deadline” must be requested explicitly with never_expires.

• Scope: admin.users.write
• System: no
• Reachable from: POST /v1/commands/iam.api_key.create (tenant credential) · MCP tool iam.api_key.create · SDK client.call('iam.api_key.create', …)
• Events: iam.api_key.created

Input (JSON Schema)

{
  "properties": {
    "display_name": {
      "minLength": 1,
      "type": "string"
    },
    "expires_in_days": {
      "maximum": 3650,
      "minimum": 1,
      "type": "integer"
    },
    "never_expires": {
      "type": "boolean"
    },
    "scopes": {
      "default": [],
      "items": {
        "type": "string"
      },
      "type": "array"
    }
  },
  "required": [
    "display_name"
  ],
  "type": "object"
}

Result (200)

{
  "additionalProperties": false,
  "properties": {
    "api_key_id": {
      "type": "string"
    },
    "credential_id": {
      "type": "string"
    },
    "expires_at": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ]
    },
    "token": {
      "type": "string"
    }
  },
  "required": [
    "api_key_id",
    "credential_id",
    "token",
    "expires_at"
  ],
  "type": "object"
}

Errors

validation_failed (400) · unauthorized (401) · forbidden (403) · conflict (409) · internal (500)