Create an API key
POST/v1/api-keys
Returns the complete token once; it is never shown again and is stored only as a hash. This operation does not take Idempotency-Key: a retried create makes a second key, which the owner can revoke. Session-only: an API key cannot create a key.
Request
Responses
- 201
- 400
- 401
- 403
- 413
- 414
- 415
- 500
Created. The only response that carries token.
Response Headers
The request's id, to quote in support requests. Echoes the request's X-Request-Id when it was at most 200 bytes of visible ASCII; otherwise generated.
no-store: the response carries a secret or a shared report.
The path of the created resource (RFC 9110 §15.3.2).
invalid_json: the body is not one JSON object. validation_failed: a field, parameter, header or multipart part breaks a rule; errors lists every problem.
Response Headers
The request's id, to quote in support requests. Echoes the request's X-Request-Id when it was at most 200 bytes of visible ASCII; otherwise generated.
Sent on every response to an API key once the rate limiter has run: absent on 401 and 403, and on every response to a session. The quota left in the one policy the request consumed, as IETF draft-ietf-httpapi-ratelimit-headers-11 specifies, e.g. "api";r=599;t=1. It tracks the draft, and may change to follow a newer draft without being treated as a breaking change. Do not base retries on it; retry on Retry-After.
Sent whenever RateLimit is. Every policy the key is subject to, as IETF draft-11 specifies. It tracks the draft, and may change to follow a newer draft without being treated as a breaking change.
No credential, or the credential failed.
Response Headers
The request's id, to quote in support requests. Echoes the request's X-Request-Id when it was at most 200 bytes of visible ASCII; otherwise generated.
RFC 9110 §11.6.1 and RFC 6750 §3. Bearer alone when no credential, or a credential under another scheme, was sent. Bearer error="invalid_token" when the credential failed. A 403 insufficient_scope carries its own challenge, declared on the Forbidden responses.
session_required: any API key, whatever its scopes. account_not_provisioned: the session's user has no workspace.
Response Headers
The request's id, to quote in support requests. Echoes the request's X-Request-Id when it was at most 200 bytes of visible ASCII; otherwise generated.
The body is over the operation's limit: its x-body-limit, or the 1M default when it declares none.
Response Headers
The request's id, to quote in support requests. Echoes the request's X-Request-Id when it was at most 200 bytes of visible ASCII; otherwise generated.
Sent on every response to an API key once the rate limiter has run: absent on 401 and 403, and on every response to a session. The quota left in the one policy the request consumed, as IETF draft-ietf-httpapi-ratelimit-headers-11 specifies, e.g. "api";r=599;t=1. It tracks the draft, and may change to follow a newer draft without being treated as a breaking change. Do not base retries on it; retry on Retry-After.
Sent whenever RateLimit is. Every policy the key is subject to, as IETF draft-11 specifies. It tracks the draft, and may change to follow a newer draft without being treated as a breaking change.
The query string holds more than 10,000 parameters. Every &-separated pair counts, empty ones included. No parameter is at fault on its own, so the response carries no errors.
Response Headers
The request's id, to quote in support requests. Echoes the request's X-Request-Id when it was at most 200 bytes of visible ASCII; otherwise generated.
Sent on every response to an API key once the rate limiter has run: absent on 401 and 403, and on every response to a session. The quota left in the one policy the request consumed, as IETF draft-ietf-httpapi-ratelimit-headers-11 specifies, e.g. "api";r=599;t=1. It tracks the draft, and may change to follow a newer draft without being treated as a breaking change. Do not base retries on it; retry on Retry-After.
Sent whenever RateLimit is. Every policy the key is subject to, as IETF draft-11 specifies. It tracks the draft, and may change to follow a newer draft without being treated as a breaking change.
The Content-Type is not one this operation takes, or names a charset other than utf-8 on a JSON media type.
Response Headers
The request's id, to quote in support requests. Echoes the request's X-Request-Id when it was at most 200 bytes of visible ASCII; otherwise generated.
Sent on every response to an API key once the rate limiter has run: absent on 401 and 403, and on every response to a session. The quota left in the one policy the request consumed, as IETF draft-ietf-httpapi-ratelimit-headers-11 specifies, e.g. "api";r=599;t=1. It tracks the draft, and may change to follow a newer draft without being treated as a breaking change. Do not base retries on it; retry on Retry-After.
Sent whenever RateLimit is. Every policy the key is subject to, as IETF draft-11 specifies. It tracks the draft, and may change to follow a newer draft without being treated as a breaking change.
An unexpected error. Nothing was stored.
Response Headers
The request's id, to quote in support requests. Echoes the request's X-Request-Id when it was at most 200 bytes of visible ASCII; otherwise generated.
Sent on every response to an API key once the rate limiter has run: absent on 401 and 403, and on every response to a session. The quota left in the one policy the request consumed, as IETF draft-ietf-httpapi-ratelimit-headers-11 specifies, e.g. "api";r=599;t=1. It tracks the draft, and may change to follow a newer draft without being treated as a breaking change. Do not base retries on it; retry on Retry-After.
Sent whenever RateLimit is. Every policy the key is subject to, as IETF draft-11 specifies. It tracks the draft, and may change to follow a newer draft without being treated as a breaking change.