---
title: "Create Api Key"
method: POST
path: "/v1/portal/api-keys"
tags: ["Portal"]
---

# Create Api Key

`POST /v1/portal/api-keys`

## Request

- Base URL: `https://api.grafomem.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.grafomem.com/v1/portal/api-keys`
- Auth: none declared

Mint a scoped API key for the signed-in tenant.

Two shapes:
  * `{"name", "role"}` (no `scopes`) — today's behaviour: `admin` mints TENANT_ADMIN_SCOPES, `agent` and
    `read_only` their bounded role defaults. `role` defaults to `admin`.
  * `{"name", "scopes": [...]}` — a NARROW key carrying exactly the named scopes (e.g. the analyst's
    submit key: `["disposition:write", "disposition:read"]`). The list must be non-empty, in the
    vocabulary, and a subset of TENANT_ADMIN_SCOPES; otherwise 400 naming the refused scopes and
    nothing is minted. `role` defaults to `agent` (it only sets the key prefix; the stored scopes are
    the explicit list, which the resolver never widens).
The response is unchanged: `{api_key (show-once), key_id, role, scopes, expires_at}`.

## Request body

- CreateApiKeyRequest
  - `name` string
  - `role` string, nullable
  - `expires_at` integer, nullable
  - `ip_allowlist` string[], nullable
  - `scopes` string[], nullable

## Response `200`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/grafomem/apis/grafomem-cloud.md) · [All operations](https://skmtc.dev/grafomem/apis/grafomem-cloud/llms.txt) · [OpenAPI document](https://skmtc.dev/grafomem/apis/grafomem-cloud/revisions/a472af705375?raw)