---
title: "Create toolkit"
method: POST
path: "/toolkits"
tags: ["Toolkits"]
---

# Create toolkit

`POST /toolkits`

Create a toolkit and issue its first API key.

The plaintext key (`jntc_live_…`) is returned **once** in `api_key` and is
never retrievable again. Optional `credential_ids` bind existing credentials
at creation time.

## Request body

- ToolkitCreateRequest — Create a new toolkit.
  - `active` boolean
  - `credential_ids` string[], nullable
  - `description` string, nullable
  - `name` string, required
  - `permissions` JenticOneControlWebSchemasToolkitsPermissionRuleSchema[], nullable
    - `effect` 'allow' | 'deny', required — Whether this rule allows or denies the matched request.
    - `methods` string[], nullable — HTTP methods to match (case-insensitive). None matches all.
    - `operations` string[], nullable — OpenAPI operation IDs to match. None matches all operations.
    - `path` string, nullable — Regex pattern for the request path. None matches all paths.

## Response `201`

Successful Response

- ToolkitCreateResponse — Create response: toolkit + api_key shown once.
  - `api_key` string, required
  - `toolkit` ToolkitResponse, required — Toolkit response.
    - `active` boolean, required
    - `created_at` string, date-time, required
    - `created_by` string, nullable
    - `credential_count` integer, required
    - `description` string, nullable
    - `key_count` integer, required
    - `name` string, required
    - `permissions` object[], required
    - `toolkit_id` string, required
    - `updated_at` string, date-time, nullable

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `403` — Forbidden
- `422` — Unprocessable Entity
- `500` — Internal Server Error
- `503` — Service Unavailable

## Changes

- **2026-07-23** `e7b87904bdbb` — 1 info
  - added the optional property `toolkit/created_by` to the response with the `201` status
- **2026-07-01** `d65fcba0d25a` — 3 breaking, 12 warning, 23 info
  - the `detail` response's property type changed from `array` to `string` for status `422`
  - removed the required property `id` from the response with the `201` status
  - removed the required property `name` from the response with the `201` status
  - the `name` request property's maxLength was set to `255`
  - …34 more
- **2026-04-13** `76e8f6063728` — 6 breaking, 9 warning, 23 info
  - media type `application/problem+json` was changed to a more general media type `application/json` for the response status `422`
  - the response property `detail` became optional for the status `422`
  - the `detail` response property's maxLength was unset from `4096` for the response status `422`
  - the `detail` response's property type changed from `string` to `array` for status `422`
  - …34 more

[Change history](https://skmtc.dev/jentic/apis/jentic-control-plane-api/changes/toolkits/post.md)

---

[API](https://skmtc.dev/jentic/apis/jentic-control-plane-api.md) · [All operations](https://skmtc.dev/jentic/apis/jentic-control-plane-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/jentic/jentic-control-plane-api/revisions/7f8d4d76abcd/schema)