Create a new API key for the authenticated account.

POST

/account/api_key

curl --request POST \
  --url https://api.siteqwality.com/account/api_key \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "friendly_name": "example", "key_type": "ingest", "scopes": [ "example" ], "full_access": true, "expires_in_days": 1, "ingest_signals": [ "example" ], "ingest_default_service": "example", "ingest_default_env": "example" }'

• Production

The response contains the full secret. This is the ONLY time it is ever shown: only its SHA-256 is stored, so it cannot be retrieved again, only rotated.

key_type defaults to full when omitted, which is exactly what every key did before this endpoint grew types. The dashboard sends ingest explicitly, because a key destined for a log-forwarder config should not also be able to delete monitors.

Authorizations

• bearer_auth

Request Body ^required

Media type application/json

Body for POST /account/api_key.

object

friendly_name

string | null

key_type

One of:

string

Omitted means full.

This is deliberately NOT the dashboard’s default (which is ingest, the safer choice). The API default has to preserve the historical behavior, because a customer script that has been POSTing {"friendly_name": "..."} for years must keep getting a key that can do what its keys have always done.

string

Allowed values: ingest full

null

null

scopes

Scope restriction for a full key, drawn from the same read:<family> / write:<family> taxonomy as M2M clients. Rejected on an ingest key, which never reaches the scope chokepoint at all.

array | null

full_access

true asks for a full key with no scope list, which reaches the whole customer API. A full key with no scopes is refused without it. Ignored when scopes are given or on ingest keys.

boolean

expires_in_days

Optional lifetime in days. Omitted means the key never expires, which matches the Datadog model and is what every existing key does.

integer | null format: int32

ingest_signals

Ingest keys only: logs, traces, metrics, without duplicates. Omitted or empty allows all. Stored and returned in logs, traces, metrics order; non-null is rejected on full keys.

array | null

ingest_default_service

Ingest keys only: trimmed default service, at most 256 Unicode scalar values. Empty after trimming means no default. Non-null is rejected on full keys.

string | null

ingest_default_env

Ingest keys only: trimmed default environment, at most 128 Unicode scalar values. Empty after trimming means no default. Non-null is rejected on full keys.

string | null

Responses

200

Newly minted API key; the secret is only returned once

Media type application/json

Response for create and rotate, the ONLY places a full secret ever appears. It is not stored and cannot be retrieved again.

object

api_key

required

One API key in list responses. Never contains the secret: after creation the secret exists only in the customer’s hands.

object

id

required

string format: uuid

account_id

required

string format: uuid

friendly_name

string | null

key_prefix

required

First 8 characters of the secret, kept in plaintext for display.

string

key_last_four

required

Last 4 characters of the secret, kept in plaintext for display.

string

key_type

required

What a customer API key is allowed to do.

Mirrors the Datadog split between an API key (telemetry push) and an application key (full API access), collapsed into one credential with a type so the ingest path and the management path can share a table.

string

Allowed values: ingest full

scopes

required

Empty means unrestricted.

Array<string>

ingest_signals

required

Allowed ingest signals; empty means all. New values use logs, traces, metrics order.

Array<string>

ingest_default_service

Stored default service for ingest; does not grant a signal permission.

string | null

ingest_default_env

Stored default environment for ingest; does not grant a signal permission.

string | null

status

required

Lifecycle state of a key, derived rather than stored so it can never disagree with the timestamps.

string

Allowed values: active expired revoked

created_at

required

string format: date-time

last_used_at

string | null format: date-time

expires_at

string | null format: date-time

revoked_at

string | null format: date-time

secret

required

The full secret. Shown exactly once; store it now.

string

Example

{
  "api_key": {
    "key_type": "ingest",
    "status": "active"
  }
}

400

Invalid name, scopes, expiry or ingest settings, or key cap reached

401

Missing or invalid authentication

403

Caller is not an admin

500

Internal server error