ApiKeys

Create a tracing key for a monitor

Mints a tracing key: an ingest-scoped key bound to this monitor. It can send pings, traces, metrics and logs for this one monitor and nothing else; every REST route refuses it. The plaintext key is returned exactly once, in this response. Store it in a git-ignored file or a helper script, never in committed code.

A write key may call this, unlike POST /api/v1/api-keys, because the only thing it can mint is strictly weaker than the caller: the scope is always ingest, check_id is always this monitor, and the body accepts only name and expires_at. A read key and an ingest key are refused with 403. A monitor of another project is 404, the same as a missing one.

The caps of POST /api/v1/api-keys apply unchanged: under a calling key that expires, the new key cannot outlive it (a later expires_at is 400 with max_expires_at; an omitted one inherits the caller's expiry), and revoking the calling key revokes this one. A session caller (the console) sends the CSRF header like every other write.

post/api/v1/checks/{id}/ingest-keys

Request

  • Base URL: https://app.lastping.dev
  • URL: https://app.lastping.dev/api/v1/checks/{id}/ingest-keys
  • Auth: API key in header X-Api-Key

Request body

namestring

Label for the key. Defaults to "Tracing:" followed by the monitor's name.

expires_atstring date-time

Optional RFC 3339 expiry, in the future. Capped by the calling key's own expiry exactly as POST /api/v1/api-keys caps it: a later value is refused with 400 and max_expires_at, and an omitted value under an expiring key inherits that key's expiry.

Example request

{
  "name": "Tracing: nightly agent",
  "expires_at": "2026-12-31T00:00:00Z"
}

Response

Tracing key created. key is the plaintext credential, shown exactly once; scope is ingest and check_id is this monitor.

idstring uuid required

Unique API key identifier.

namestring required

Human-readable label for the key.

prefixstring required

First 10 characters of the key — a non-secret identifier shown in place of the full value.

created_atstring date-time required

RFC 3339 UTC timestamp when the key was created.

expires_atstring date-time

RFC 3339 UTC expiry timestamp, or omitted for a key that never expires.

last_used_atstring date-time

RFC 3339 UTC timestamp of the most recent request this key authenticated. Omitted if the key has never been used since this field was added — never rendered as a zero/epoch time.

last_used_surface'mcp' | 'terraform' | 'api' | 'ingest'

Which client surface last used this key, omitted if unknown. ingest means the latest use was sending telemetry (traces, metrics or logs); telemetry use is recorded about once a minute per key, so last_used_at can trail the newest export by up to a minute. For mcp, terraform and api the value is best-effort and spoofable: derived from the caller-controlled User-Agent header on the authenticating request, not from any cryptographic or protocol-level signal. Useful for an honest "did my client ever successfully authenticate?" indicator — never use it for authorization or access control.

scope'read' | 'write' | 'admin' | 'ingest' required

What this key is permitted to do. Always present. Unlike last_used_surface above — which is a spoofable hint derived from a caller-supplied header — this is the value the server actually checks. ingest sends telemetry only and cannot call this API.

check_idstring uuid

The one monitor an ingest key is bound to. Omitted for an unbound key and for every key of another scope.

created_by_key_idstring uuid

The API key that minted this one, omitted for a key created from the dashboard (which has no parent key) or whose parent has since been deleted.

Revoking a key revokes every key below it in this chain. A key minted by a key minted by the key you delete goes with it, all at once. A key created from the dashboard is never below anything and is unaffected.

keystring required

The plaintext API key. Store it immediately — it cannot be retrieved again.

Example response

{
  "id": "e1d2c3b4-0000-0000-0000-000000000001",
  "name": "github-actions",
  "prefix": "lp_Wwut111",
  "created_at": "2026-07-01T12:00:00Z",
  "expires_at": "2026-12-31T00:00:00Z",
  "last_used_at": "2026-08-01T09:30:00Z",
  "last_used_surface": "mcp",
  "scope": "write",
  "check_id": "6ba7b810-9dad-11d1-80b4-00c04fd430c8",
  "created_by_key_id": "e1d2c3b4-0000-0000-0000-000000000002",
  "key": "lp_Wwut111f_jHpogymaQLg5L19-MuWcVVY"
}

Changes

No recorded changes to this operation across all 2 revisions of this API.