Create an API key
POST/api-keys
Creates an API key and returns it once. Store it securely; it cannot be retrieved again.
An API key is a JWT that never expires and is not itself an access token. Exchange it for a short-lived
access token with POST /api-keys/auth. Always send linkedUsers: the access token takes the role of
the linked user, and a key with no linked user cannot authenticate.
Must be called with an Active Directory user's token; the built-in secureone account cannot create API
keys (400, createdBy validation error).
Both application/json and application/x-www-form-urlencoded bodies are accepted.
Required role: superadmin or admin.
Request
Responses
- 200
- 400
- 401
- 403
The API key was created.
The key could not be created, for example appName is missing or already used (an appName must be unique), linkedUsers contains an unknown user id (linkedUsers contains invalid userIDs) or a value that is not a valid user id, scopes has an unsupported value, or the caller is the built-in secureone account
(createdBy contains invalid userID). The message field can hold a structured validation object rather than a plain string.
No token, or the token is invalid or expired. The body is {message}: No auth token provided when no token is sent, otherwise the token check's message (jwt expired, jwt malformed, invalid signature, invalid token, jwt signature is required). Send Authorization: Bearer <token> exactly: the server drops the first seven characters of the header and reads the rest as the token, so a different scheme or an extra space fails. If Authorization is absent, the server reads a token field in the body, then a token query parameter, then x-access-token. Routes that validate query fields reject ?token= with 400 InvalidQuery.
The token's role is not allowed for this operation, or the token's scopes exclude the route
(Scope not allowed by token).