Skip to main content
POST

​
Request Body

​
string
required
Display name for the API key (e.g., “CI Pipeline”, “Backup Service”)
​
string
Description of what this key is used for
​
string
Restrict key to a specific tenant
​
string
Restrict key to a specific environment
​
string
ISO 8601 expiration date. If omitted, key does not expire.
​
string
Intended use case (e.g., “ci-cd”, “backup”, “reporting”)
​
string
default:"user"
Credential tier controlling which API surfaces this key may reach:
  • user — acts as a single subject (the default); reaches the management surface as that subject.
  • service — a consuming application / sidecar. Required to call the decision path (POST /evaluate, GET /effective-permissions); may assert any subject within its own tenant (set tenantId).
  • platform — a Bedrock operator credential. Required to reach the core control-plane endpoints (roles, permissions, scopes, resources, policies, tags, subjects, memberships, overrides).
Omitting kind defaults to user. Choose the least-privileged tier the key needs. (kind is the credential’s authorization tier — distinct from the subject’s subjectType.)
​
object
Custom metadata

​
Response

Returns the created API key object including the secret key.
The secret key is only returned once at creation time. Store it securely—it cannot be retrieved later.
Creating an API key also creates an associated Bedrock subject with type service. This subject can be used for permission checks and role assignments.