Mint a virtual key. The secret is returned EXACTLY once. Honors an `Idempotency-Key` header (per-principal ~10min replay)

Token expiry as an absolute Unix-seconds timestamp. Mutually exclusive with expires_in.

Token lifetime as a duration string (7d, 24h, 30m, 3600s) - the token's exp is now + expires_in. Mutually exclusive with expires_at. Absent (and no expires_at) => a sane long default (see DEFAULT_KEY_TTL_SECS).

The groups: bucket this key binds to (at most one). A key with NO group is authed + unlimited (access only). If the named group EXISTS, the key binds to it. If it does NOT exist, the mint 400s UNLESS parent is given, in which case it is AUTO-PROVISIONED as a leaf under parent (self-service; see parent).

When true, ALSO issue an AWS-style access-key-id + secret access key (the MinIO/S3-compatible model) so a Bedrock-SDK client can authenticate via inbound SigV4. Both are returned ONCE.

AUTO-PROVISION target: the EXISTING parent group under which to create group as a leaf when group does not yet exist: the first-self-mint materialization of a user:<sub> personal budget bucket. The new leaf's limits come from the nearest-ancestor child_default template (inherit-only when none up the chain), created through the same validate-at-the-door path as POST /groups. If group ALREADY exists, parent must equal its actual parent (else 409); a mint never re-homes an existing group. Ignored when group is absent (a key with no group has nothing to provision).

AWS AccessKeyId (present only when issue_aws_credential was set). Not secret.

AWS SigV4 secret access key, shown once (present only with an AWS credential).

Unix-seconds expiry of the signed token.

Whether this mint AUTO-PROVISIONED its bound group leaf (self-service); lets a portal distinguish "bound to an existing bucket" from "created your personal bucket + bound".

Same field as KeyView.state; a fresh mint is always "active" (enabled, not revoked, not deleted).

The busbar-SIGNED token: the key credential (1.5.0), shown EXACTLY once and never returned by any read. (This is the field a client must capture to authenticate.)