Create a new API key

{ "id": "<string>", "name": "<string>", "token": "<string>", "workspace_id": "<string>", "access": {}, "active": true, "constraints": { "expires_at": "2023-11-07T05:31:56Z" }, "created": "2023-11-07T05:31:56Z", "created_by_id": "<string>", "expiration": "<string>", "is_legacy": true, "last_used_at": "2023-11-07T05:31:56Z", "legacy_key_id": "<string>", "legacy_token_family": "<string>", "owner": { "type": "<string>", "user_id": "<string>" }, "permission_mode": "all", "project_scope": { "mode": "<string>", "project_id": "<string>" }, "projects": [ "<string>" ], "source": "<string>", "status": "active", "token_prefix": "<string>", "updated": "2023-11-07T05:31:56Z", "updated_by_id": "<string>" }

Authorizations

Authorization

string

header

required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Body

application/json

name

string

required

Display name of the key.

Maximum string length: 100

access

object

Per-domain access level (none, read or write) for restricted keys; domain ids come from the capability catalog.

Show child attributes

constraints

object

Expiry and other limits applied to the key.

Show child attributes

expiration

string<date-time>

Legacy expiry as an RFC 3339 timestamp; prefer constraints.expires_at.

owner

object

Lifecycle binding: a user-owned key is revoked with the user, a service-account key outlives any user.

Show child attributes

permission_mode

enum<string>

Permission preset; restricted keys hold only the domains granted in access.

Available options:

all,

restricted,

read_only

project_scope

object

Projects the key may reach: every project of the workspace or a single one.

Show child attributes

projects

string[] | null

Legacy single-project binding; prefer project_scope.

Maximum array length: 1

source

enum<string>

Origin of the key; router keys are minted for the AI router.

Available options:

workspace,

router

Response

The created API key with its raw token

string

required

Unique identifier of the key.

name

string

required

Display name of the key.

token

string

required

The raw secret on create only; a masked display value everywhere else.

workspace_id

string

required

Workspace the key belongs to.

access

object

Show child attributes

active

boolean

constraints

object

Show child attributes

created

string<date-time>

created_by_id

string

expiration

string

is_legacy

boolean

last_used_at

string<date-time>

legacy_key_id

string

legacy_token_family

string

owner

object

Show child attributes

permission_mode

enum<string>

Available options:

all,

restricted,

read_only

project_scope

object

Show child attributes

projects

string[] | null

source

string

status

enum<string>

Available options:

active,

disabled,

revoked

token_prefix

string

Display prefix of the secret; not usable as a credential.

updated

string<date-time>

updated_by_id

string

Orq SDK

Terminal & Agents

Terraform

Platform APIs

Management APIs

Authorizations

Body

Response