KEkeycardai
Zones

Create zone

Changed on

Creates a new zone for the authenticated organization. A zone is an isolated environment for IAM resources.

post/zones

Request

  • Base URL
    https://docs.keycard.ai (the document declares no server; this is the origin it was published from)
  • URL
    https://docs.keycard.ai/zones
  • Auth
    • HTTP bearer
    • or OAuth 2
      Client credentials
      Token URL: /service-account-token

Request body

namestring safe-text required

Human-readable name. Must not contain HTML tags (e.g. <script>, <div>) or control characters.

descriptionstring safe-text nullable

Human-readable description. Must not contain HTML tags (e.g. <script>, <div>) or control characters.

organization_idstring

Target organization ID. Required for platform principals (whose tokens carry no organization claim); for organization-scoped principals it is optional and must match the authenticated organization if supplied.

default_mcp_gateway_applicationboolean

Assign a default MCP Gateway application to the zone

Response

A zone for organizing resources within an organization

idstring required

Unique identifier of the zone

organization_idstring required

Organization that owns this zone

slugstring required

URL-safe identifier, unique within the zone

namestring required

Human-readable name

descriptionstring nullable

Human-readable description

user_identity_provider_idstring

Provider ID configured for user login

external_sync_enabledboolean required

Whether external directory sync (SCIM) is enabled for this zone. Required to create external sync tokens.

default_mcp_gateway_application_idstring

Application ID configured as the default MCP Gateway for the zone

default_resource_idstring

Resource ID configured as the default resource for the zone

permissionsIamPermissions

Permissions granted to the authenticated principal. Only populated when expand[]=permissions query parameter is provided. Keys are resource types, values are objects mapping action names to boolean values.

owner_type'platform' | 'customer' required

Who owns this zone. Platform-owned zones cannot be modified via API.

created_atstring date-time required

Entity creation timestamp

updated_atstring date-time required

Entity update timestamp

Example response

{
  "permissions": {
    "zones": {
      "read": true,
      "update": true,
      "delete": false,
      "create": false
    },
    "applications": {
      "read": true,
      "list": true,
      "create": false
    }
  }
}

Changes

  • 0dee67e0a73aRevision changes
    • warning

      removed the request property

    • warning

      removed the optional property from the response with the status

  • 0cfaff865771Revision changes
    • info

      added the required property to the response with the status