Create a new API key for the authenticated account.

POST

/account/api_key/

curl --request POST \
  --url https://api.siteqwality.com/account/api_key/ \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "friendly_name": "example", "key_type": "ingest", "scopes": [ "example" ], "expires_in_days": 1 }'

• Production

The response contains the full secret. This is the ONLY time it is ever shown: only its SHA-256 is stored, so it cannot be retrieved again, only rotated.

key_type defaults to full when omitted, which is exactly what every key did before this endpoint grew types. The dashboard sends ingest explicitly, because a key destined for a log-forwarder config should not also be able to delete monitors.

Authorizations

• bearer_auth

Request Body ^required

Media type application/json

Body for POST /account/api_key.

object

friendly_name

string | null

key_type

One of:

null

null

string

Omitted means full.

This is deliberately NOT the dashboard’s default (which is ingest, the safer choice). The API default has to preserve the historical behaviour, because a customer script that has been POSTing {"friendly_name": "..."} for years must keep getting a key that can do what its keys have always done.

string

Allowed values: ingest full

scopes

Optional scope restriction for a full key. Omitted or empty means unrestricted, which is how every existing key behaves. Must be drawn from the same read:<family> / write:<family> taxonomy as M2M clients. Rejected on an ingest key, which never reaches the scope chokepoint at all.

array | null

expires_in_days

Optional lifetime in days. Omitted means the key never expires, which matches the Datadog model and is what every existing key does.

integer | null format: int32

Responses

200

Newly minted API key; the secret is only returned once

Media type application/json

Response for create and rotate, the ONLY places a full secret ever appears. It is not stored and cannot be retrieved again.

object

api_key

required

One API key in list responses. Never contains the secret: after creation the secret exists only in the customer’s hands.

object

id

required

string format: uuid

account_id

required

string format: uuid

friendly_name

string | null

key_prefix

required

First 8 characters of the secret, kept in plaintext for display.

string

key_last_four

required

Last 4 characters of the secret, kept in plaintext for display.

string

key_type

required

What a customer API key is allowed to do.

Mirrors the Datadog split between an API key (telemetry push) and an application key (full API access), collapsed into one credential with a type so the ingest path and the management path can share a table.

string

Allowed values: ingest full

scopes

required

Empty means unrestricted.

Array<string>

status

required

Lifecycle state of a key, derived rather than stored so it can never disagree with the timestamps.

string

Allowed values: active expired revoked

created_at

required

string format: date-time

last_used_at

string | null format: date-time

expires_at

string | null format: date-time

revoked_at

string | null format: date-time

secret

required

The full secret. Shown exactly once; store it now.

string

Example

{
  "api_key": {
    "key_type": "ingest",
    "status": "active"
  }
}

400

Invalid name, scopes or expiry, or key cap reached

401

Missing or invalid authentication

403

Caller is not an admin

500

Internal server error