auth

Create an API key.

Mints a dvt-issued key for the caller's user + organization. By default the key acts AS its creator (same role, same tenant); pass scopes to confine it to a least-privilege subset of capabilities (DVT-33) — recommended for MCP/customer keys. The response carries the plaintext once; only its SHA-256 is stored. Admin/owner (apikey:manage) always permitted; members may also mint their own keys when the org has allowMemberApiKeys enabled (DVT-342). A key can never exceed its creator's own role capabilities. An admin/owner may also pass userId to mint the key ON BEHALF OF another org member (DVT-950) — the key then authenticates and attributes as that member, independent of allowMemberApiKeys (which governs member self-service only).

post/v1/api-keys

Request

  • Base URL: http://localhost:8080
  • URL: http://localhost:8080/v1/api-keys
  • Auth: one of:
    • API key in cookie dvt_session
    • HTTP bearer

Request body

namestring required

Human label, e.g. 'ci-bot'.

scopesstring[]

Optional capability subset to confine the key to (intersected with the creator's role, or with userId's role when set; a key can never exceed its effective owner). Omit/empty = the key holds its owner's full role capabilities. Each value must be a capability the owner's own role holds, else 400. See ApiKey.scopes for the vocabulary.

expiresInDaysinteger

Omit for no expiry.

userIdstring uuid

Admin/owner only: mint the key for this org member instead of yourself. The key authenticates as, and attributes to, that user. Independent of allowMemberApiKeys (that setting governs member self-service only). Cannot target a member whose role outranks yours.

Response

The new key. Store data.key now — it is never shown again.

Changes

No recorded changes to this operation across all 1 revision of this API.