---
title: "Mint a scope-narrowed child API key"
method: POST
path: "/api/v1/keys/child"
tags: ["delegation"]
---

# Mint a scope-narrowed child API key

`POST /api/v1/keys/child`

## Request

- Base URL: `https://api.agenticcontrolplane.com`
- URL: `https://api.agenticcontrolplane.com/api/v1/keys/child`
- Auth: HTTP bearer

The delegation-chain primitive (ADCS): a parent key mints a child key bound to a delegatable agent profile. Scopes intersect with the parent's, budget clamps to the parent's remaining, TTL caps at 24h, `originSub` is preserved for end-to-end audit. Feature-flagged; 404 when disabled. Rate limited per tenant.

## Request body

- object
  - `profileId` string, required: Delegatable agent profile the child is bound to.
  - `scopes` string[]: Optional further narrowing; cannot widen beyond the parent.
  - `maxBudgetCents` integer
  - `ttlSeconds` integer
  - `reason` string: Free-text audit label.

## Response `200`

The child key (returned once).

- object
  - `ok` boolean

## Other responses

- `400`: Validation failed.
- `401`: Missing, malformed, invalid, or revoked gsk_ API key.
- `403`: Profile not delegatable.
- `404`: Profile not found / feature disabled.
- `409`: Delegation cycle detected.
- `429`: Rate limited. Standard draft-7 RateLimit / RateLimit-Policy headers are set; retry after the window resets.
- `500`: Server error.

---

[API](https://skmtc.dev/agenticcontrolplane/apis/agentic-control-plane-gateway-api.md) · [All operations](https://skmtc.dev/agenticcontrolplane/apis/agentic-control-plane-gateway-api/llms.txt) · [OpenAPI document](https://skmtc.dev/agenticcontrolplane/apis/agentic-control-plane-gateway-api/revisions/161819f3df00?raw)