---
title: "Issue Agent Credential"
method: POST
path: "/agents/{id}/credentials"
tags: ["agents-credentials"]
---

# Issue Agent Credential

`POST /agents/{id}/credentials`

## Request

- Base URL: `https://api.instruxi.dev/api/v1/enforcer`
- URL: `https://api.instruxi.dev/api/v1/enforcer/agents/{id}/credentials`
- Auth: one of:
  - API key in header `Authorization`
  - API key in header `X-API-Key`

Mints an ag_ credential for the agent. The secret is returned exactly once. Scopes must be known (400 invalid_scope) and covered by the agent's scopes and the caller's own (403 insufficient_scope); the TTL defaults to the tenant policy's default and may not exceed its maximum (400 ttl_exceeds_tenant_max); an agent or portal credential cannot mint (403 agent_cannot_mint); no minting on a non-active agent (409 agent_suspended).

## Path parameters

- `id` string, required

## Request body

- InternalDeliveryHttpHandlerIssueAgentCredentialRequest
  - `expires_in_days` integer: ExpiresInDays defaults to the tenant policy's default and may not exceed its maximum.
  - `name` string
  - `scopes` string[]

## Response `201`

Created

- InternalDeliveryHttpHandlerIssuedAgentCredentialResponse
  - `data` EnforcerV3InternalUsecaseAgentsIssuedCredential
    - `credential` EnforcerV3InternalUsecaseAgentsCredentialView
      - `agent_id` string
      - `created_at` string
      - `created_by` string
      - `expires_at` string
      - `id` string
      - `key_prefix` string
      - `last_used_at` string
      - `last_used_ip` string
      - `name` string
      - `revoked_at` string
      - `rotated_from` string
      - `scopes` string[]
    - `secret` string: Secret is the ag_ credential, shown exactly once.
  - `success` boolean

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `403`: Forbidden
- `404`: Not Found
- `409`: Conflict

---

[API](https://skmtc.dev/instruxi/apis/enforcer-api.md) · [All operations](https://skmtc.dev/instruxi/apis/enforcer-api/llms.txt) · [OpenAPI document](https://skmtc.dev/instruxi/apis/enforcer-api/revisions/fa82bc1becc0?raw)