Skip to content
InternetData

Create

post/api/v1/iam/apikeys

Creates a key and returns its secret.

This is the ONLY response that ever carries the secret, and only because this is the moment it comes into existence. Store it now.

Authorization

BearerAuthbearer token

Authorization: Bearer <key>, with a key from the console. Keys are default-deny: each operation names the scope it needs, and an existing key does not gain an operation until that scope is added to it.

Scopes: apikeys.manage

Request body

application/json

namerequiredstring

A label you will recognize later. Shown wherever the key is listed.

allowed_scopesarray<string>

What the new key may do. Omit for a key that carries no named scope, which is the safe default.

Responses

200application/json

The new key, including its secret.

rcrequiredstring
idrequiredstring (uuid)
namestring
keyrequiredstring

The secret. Returned once, here, and never again.

key_prefixstring
allowed_cidrsarray<string>
allowed_scopesarray<string>
TypeScript type
ts
{
  rc: string;
  id: string;
  name?: string;
  key: string;
  key_prefix?: string;
  allowed_cidrs?: string[];
  allowed_scopes?: string[];
}
400application/json

The request body is missing a required field.

rcrequiredstring

The outcome. SUCCESS on success; otherwise the reason.

TypeScript type
ts
{
  rc: string;
}
401application/json

No credential was presented, or it is not valid.

rcrequiredstring

The outcome. SUCCESS on success; otherwise the reason.

TypeScript type
ts
{
  rc: string;
}
403application/json

The credential does not hold the scope this endpoint requires. The missing scope is deliberately not named.

rcrequiredstring

The outcome. SUCCESS on success; otherwise the reason.

TypeScript type
ts
{
  rc: string;
}