---
title: "Issue a scoped service credential. Its token is returned exactly once."
method: POST
path: "/v1/service-credentials"
---

# Issue a scoped service credential. Its token is returned exactly once.

`POST /v1/service-credentials`

## Request

- Base URL: `http://127.0.0.1:8080`
- URL: `http://127.0.0.1:8080/v1/service-credentials`
- Auth: HTTP bearer

## Headers

- `X-Likerts-Workspace` string

## Request body

- CredentialInput
  - `name` string, required
  - `scopes` OAuthScope[], required
  - `expiresAt` string, date-time, required

## Response `201`

Token is returned once.

- IssuedServiceCredential
  - `credential` ServiceCredential, required
    - `id` string, uuid, required
    - `workspaceId` string, required
    - `name` string, required
    - `scopes` OAuthScope[], required
    - `expiresAt` string, date-time, required
    - `revoked` boolean, required
  - `token` string, required

## Other responses

- `400`: Invalid input, resource identifier or workspace selection.
- `401`: Unauthorized.
- `403`: The credential scope, membership or role does not permit this operation.
- `413`: JSON request body exceeds 65536 bytes.
- `415`: Content-Type must be application/json.
- `429`: Admission or collection rate limit reached. Honor Retry-After in seconds; admission usually returns1, the collection minute window returns60.
- `500`: Internal failure; do not assume a write failed. Retry only with its original idempotency key and payload.
- `503`: Distributed request admission is temporarily unavailable. No protected handler ran; honor Retry-After.

---

[API](https://skmtc.dev/likerts/apis/likerts-development-api.md) · [All operations](https://skmtc.dev/likerts/apis/likerts-development-api/llms.txt) · [OpenAPI document](https://skmtc.dev/likerts/apis/likerts-development-api/revisions/c583fa096c07?raw)