Skip to content
VPNDetection

Create

post/api/v1/iam/apikeys

Creates a key and returns its secret.

Store the secret now. Reading it back later takes reveal and the apikeys.reveal scope.

Authorization

bearerAuthbearer token

Authorization: Bearer <key>.

Scopes: apikeys.manage

Request body

application/json

namerequiredstring

A label you will recognize later. Shown wherever the key is listed.

allowed_scopesarray<string>

What the new key may do. Omit for a key that carries no named scope, which is the safe default.

Responses

200application/json

The new key, including its secret.

rcrequiredstring
idrequiredstring (uuid)
namestring
keyrequiredstring

The secret. Returned once, here, and never again.

key_prefixstring
allowed_cidrsarray<string>
allowed_scopesarray<string>
TypeScript type
ts
{
  rc: string;
  id: string;
  name?: string;
  key: string;
  key_prefix?: string;
  allowed_cidrs?: string[];
  allowed_scopes?: string[];
}
400application/json

The request body is missing a required field.

rcrequiredstring

The outcome. SUCCESS on success; otherwise the reason.

TypeScript type
ts
{
  rc: string;
}
401application/json

No credential was presented, or it is not valid.

rcrequiredstring

The outcome. SUCCESS on success; otherwise the reason.

TypeScript type
ts
{
  rc: string;
}
403application/json

The credential does not hold the scope this endpoint requires. The missing scope is deliberately not named.

rcrequiredstring

The outcome. SUCCESS on success; otherwise the reason.

TypeScript type
ts
{
  rc: string;
}