Account

Mint a new API key for the signed-in consumer

Generates a fresh API key for the signed-in consumer. The plaintext_key field is returned EXACTLY ONCE in the 201 body — record it before leaving the page; the server only persists the SHA-256 hash and cannot reissue. Atomic max-3-active-keys-per-consumer enforcement via the create_consumer_key RPC's pg_advisory_xact_lock; concurrent POSTs race correctly. Inline rate-limit at 10/hour per consumer, fail-CLOSED. Session-cookie auth — NOT Bearer. NEVER wrapped with withIdempotency: caching the response body would keep plaintext recoverable from the DB for 24h, defeating.

post/api/v1/account/keys

Request

Base URL: https://www.apier.no
URL: https://www.apier.no/api/v1/account/keys
Auth: API key in cookie sb-access-token

Request body

namestring required

Human-readable label shown in the /dashboard keys table. e.g. 'Local dev', 'CI pipeline'.

scopesstring[]

Optional. The scopes the new key carries: any combination of the read:* wildcard, the individual read scopes and fullmakt:write. Two assignable scopes advertised on GET /api/v1/capabilities are NOT self-mintable and are refused here: subscribe:webhooks (a Pro-tier surface) and admin:keys (an operator grant). Omitted means the historical default ["read:*"] — every read scope and nothing else. read:* does NOT include fullmakt:write: a key that should create agent principals or broker and revoke a fullmakt names it explicitly, e.g. ["read:*", "fullmakt:write"]. Reserved prefixes (write:, act:, delegate:) are not accepted (400 VALIDATION_FAILED) and are additionally refused by the database CHECK.

Example request

{
  "scopes": [
    "read:*",
    "fullmakt:write"
  ]
}

Response

Key minted. plaintext_key is the ONLY copy the consumer will ever see. Response carries the standard X-Correlation-ID + Link tracing headers (applied to every /api/v1/* response) AND the full no-cache directive set Cache-Control: no-store, private, max-age=0, must-revalidate + Pragma: no-cache + Expires: 0 — defense in depth so no CDN / SW / proxy ever caches the plaintext body.

successtrue required

Example response

{
  "_meta": {
    "rulebook_version": "v1.0.0",
    "source": "apier.no",
    "data_source": "Brønnøysund Enhetsregisteret + Apier Universal Rulebook",
    "schema_version": "1.0.0",
    "legal_basis": "NLOD — public registry reuse",
    "response_timestamp": "2026-04-24T12:00:00.000Z",
    "response_hash": "sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
    "source_snapshot_id": "brreg-2026-04-24T02:00:00.000Z",
    "cost_nok": 0.5,
    "wallet_remaining_nok": 9.5,
    "spend_cap_remaining_nok": 12.5
  }
}

Changes

No recorded changes to this operation across all 1 revision of this API.