Account

Mint a narrower credential

Least privilege for agents (PLAN §8.2). Hand a subtask a credential that can only do the subtask: an hour of life, one deployment, no spending.

A child can never exceed its parent, on any axis — scopes, lifetime, budget, or which resources it may touch (the monthly budget and resource quotas are axes too). Asking for more is refused with the reason, never silently trimmed.

Over REST the parent is the API key making the call, so its granted scopes are the ceiling; there is no expiry or spend history to clamp to, and the absolute caps apply instead. Minting from an MCP token (via impreza_mint_subcredential) additionally clamps the child to the parent's remaining lifetime and remaining daily budget (and, once released, its remaining monthly budget).

The scope on this route is read, which looks wrong for a write and is not: attenuation is the authority check, and requiring manage would mean only the most powerful credential could ever delegate. Sprawl is bounded by per-parent and per-account limits instead.

The token is returned once. There is no path that reads it back.

post/credentials

Request

  • Base URL: https://api.imprezahost.com/v1
  • URL: https://api.imprezahost.com/v1/credentials
  • Auth: API key in header X-API-Key and API key in header X-API-Secret

Request body

scopesstring[] required
ttl_secondsinteger
spend_cap_centsinteger

Daily purchase ceiling. 0 means the credential cannot spend. Needs the manage scope.

spend_monthly_cap_centsinteger

Monthly purchase ceiling (UTC calendar month). Optional — defaults to the daily grant, so "can spend" never silently means one day's budget thirty times. Must fit what the parent has left this month; 0 with a positive daily grant is refused as a contradiction.

quotasobject

Resource ceilings, e.g. {"servers":1,"deployments":3,"previews":2,"concurrent_builds":1}. Each named dimension must fit inside the parent's number for it; a dimension left out is inherited from the parent. 0 blocks creating that resource at all.

resourcesobject

Confine the credential, e.g. {"deployment":["dpl_abc"]}. Kinds: deployment, service, domain. A kind you do NOT name is a kind the credential cannot touch at all.

labelstring

Response

The new credential, with its token (shown once)

Changes

No recorded changes to this operation across all 1 revision of this API.