---
title: "Create a honeytoken"
method: POST
path: "/v1/risk/honeytokens"
tags: ["Risk Engine"]
---

# Create a honeytoken

`POST /v1/risk/honeytokens`

## Request

- Base URL: `https://api.1claw.co`
- URL: `https://api.1claw.co/v1/risk/honeytokens`
- Auth: HTTP bearer

Register a secret path as a honeytoken (canary). Any access to this secret
triggers a risk event and increments the trigger counter.

## Request body

- CreateHoneytokenRequest
  - `vault_id` string, uuid, required
  - `secret_path` string, required: Vault secret path to monitor as a canary
  - `notes` string: Optional human-readable notes about this honeytoken

## Response `201`

Honeytoken created

- object
  - `honeytoken` Honeytoken
    - `id` string, uuid, required
    - `vault_id` string, uuid, required
    - `org_id` string, uuid, required
    - `secret_path` string, required
    - `created_by` string, uuid, required
    - `created_at` string, date-time, required
    - `notes` string, nullable
    - `triggered_count` integer, required
    - `last_triggered_at` string, date-time, nullable

## Other responses

- `400`: Invalid request
- `401`: Authentication required or invalid

---

[API](https://skmtc.dev/1claw/apis/1claw-api.md) · [All operations](https://skmtc.dev/1claw/apis/1claw-api/llms.txt) · [OpenAPI document](https://skmtc.dev/1claw/apis/1claw-api/revisions/5fa0918f3b41?raw)