---
title: "Create an API Credential"
method: POST
path: "/v1/organizations/{organizationId}/api-credentials"
tags: ["apiCredentials"]
---

# Create an API Credential

`POST /v1/organizations/{organizationId}/api-credentials`

Create a new API Credential for the specified Organization.

## Path parameters

- `organizationId` string, required

## Request body

- ApiCredentialCreateRequestDTO
  - `name` string, required — Human-readable name of the API Credential.
  - `description` string, required — Brief description of the purpose and usage for the API Credential.
  - `enabled` boolean, required — If <code>true</code>, the API Credential is enabled. Otherwise, <code>false</code>.
  - `roles` ApiCredentialRolesSchema, required
    - `organizationRole` 'owner' | 'admin' | 'user', required — Organization-level Role assigned to the API Credential.
    - `workspaces` WorkspaceRoleSchema[] — Workspace-level Roles assigned to the API Credential.
      - `workspaceId` string, required — Unique ID of the Workspace.
      - `workspaceRole` 'owner' | 'admin' | 'user' | 'noaccess', required — Role assigned to the API Credential on the Workspace.
      - `products` ProductRoleSchema[] — Product-level Roles assigned to the API Credential for the Workspace.
        - `product` 'edge' | 'search' | 'stream' | 'lake' | 'insights', required — Product name.
        - `role` 'admin' | 'editor' | 'reader' | 'user' | 'noaccess', required — Role assigned to the API Credential on the product.
  - `ipAllowlist` string[] — CIDR range enforced as the IP allowlist for the API Credential.

## Response `201`

API Credential created

- ApiCredentialCreateResponseSchema
  - `name` string, required — Human-readable name of the API Credential.
  - `description` string, required — Brief description of the purpose and usage for the API Credential.
  - `enabled` boolean, required — If <code>true</code>, the API Credential is enabled. Otherwise, <code>false</code>.
  - `organizationId` string, required — Unique ID of the Organization.
  - `clientId` string, required — Client ID for the API Credential.
  - `roles` ApiCredentialRolesSchema, required
    - `organizationRole` 'owner' | 'admin' | 'user', required — Organization-level Role assigned to the API Credential.
    - `workspaces` WorkspaceRoleSchema[] — Workspace-level Roles assigned to the API Credential.
      - `workspaceId` string, required — Unique ID of the Workspace.
      - `workspaceRole` 'owner' | 'admin' | 'user' | 'noaccess', required — Role assigned to the API Credential on the Workspace.
      - `products` ProductRoleSchema[] — Product-level Roles assigned to the API Credential for the Workspace.
        - `product` 'edge' | 'search' | 'stream' | 'lake' | 'insights', required — Product name.
        - `role` 'admin' | 'editor' | 'reader' | 'user' | 'noaccess', required — Role assigned to the API Credential on the product.
  - `ipAllowlist` string[], required — CIDR range enforced as the IP allowlist for the API Credential. An empty array means that the API Credential has no IP restrictions.
  - `createdBy` string, required — Member who created the API Credential.
  - `createdDate` string, date-time, required — ISO 8601 timestamp when the API Credential was created.
  - `lastUpdatedBy` string, required — Member who last updated the API Credential.
  - `lastUpdatedDate` string, date-time, required — ISO 8601 timestamp when the API Credential was last updated.
  - `clientSecret` string, required — Client Secret for the API Credential. The Client Secret is sensitive information and should be kept private. Returned only in the <code>POST</code> response when the API Credential is created. Never returned in <code>GET</code> responses. If you need the Client Secret again, you must rotate credentials and retrieve the new Client Secret from the <code>POST</code> response.

## Other responses

- `409` — Could not create API Credential because it already exists
- `422` — API Credential limit reached
- `default` — Default error response

## Changes

- **2026-08-12** `6129323514c1` — 1 warning, 1 info
  - added the new `insights` enum value to the `roles/allOf[#/components/schemas/ApiCredentialRolesSchema]/workspaces/items/products/items/product/allOf[#/components/schemas/ProductName]/` response property for the response status `201`
  - added the new `insights` enum value to the request property `roles/allOf[#/components/schemas/ApiCredentialRolesSchema]/workspaces/items/products/items/product/allOf[#/components/schemas/ProductName]/`
- **2026-04-22** `53d0b0012c3a` — 2 info
  - added the new optional request property `ipAllowlist`
  - added the required property `ipAllowlist` to the response with the `201` status
- **2026-03-18** `aecdd0a7e96c` — 1 info
  - added the non-success response with the status `409`
- **2026-03-13** `5289d0eff8a3` — 1 warning
  - the `name` request property's maxLength was set to `140`
- **2026-03-12** `da33e1b4a433` — 1 info
  - added the non-success response with the status `422`

[Full history](https://skmtc.dev/criblio/apis/cribl-cloud-public-api/changes/v1/organizations/:organizationId/api-credentials/post.md)

---

[API](https://skmtc.dev/criblio/apis/cribl-cloud-public-api.md) · [All operations](https://skmtc.dev/criblio/apis/cribl-cloud-public-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/criblio/cribl-cloud-public-api/revisions/3fc9757c4c89/schema)