ApiKeyCreateRequest

Request to create an API key. The key is always owned by the calling principal (owner is never client-supplied). scopes must each be a subset of the principal's own access; super_user may be true only when the caller is itself super-user. A key must request either super_user=true or at least one scope. expires_at, if given, is an ISO-8601 instant in the future. Self-service mints live keys only.

namestringnullable

Human-readable label for the key

Example: billing-sync

scopes object[]nullable

Per-network access to grant the key; each scope must be a subset of the caller's own access. Provide either this or super_user.

Array [

network_idstringnullable

The network this scope grants access to

Example: 7Hb2Kp9QvL3mNx0R8tZ4

rolestringnullable

The role to grant on this network; must be a subset of the caller's own role there

Possible values: [read_only, administrator]

Example: read_only

]

super_userbooleannullable

Request cross-network (super-user) access; allowed only when the caller is itself super-user. When true, scopes must be empty.

Example: false

expires_atstringnullable

Optional ISO-8601 instant in the future when the key should expire; omit for a key that never expires

Example: 2026-01-15T09:30:00Z

ApiKeyCreateRequest

{
  "name": "billing-sync",
  "scopes": [
    {
      "network_id": "7Hb2Kp9QvL3mNx0R8tZ4",
      "role": "read_only"
    }
  ],
  "super_user": false,
  "expires_at": "2026-01-15T09:30:00Z"
}