Code

Mint a short-lived, gateway-only API key bound to an agent

Owner-authenticated only (a user JWT/cookie/OAuth session, or an API key carrying api:write), at org role owner/admin on the agent's governing org (org_id resolves like GET /v1/code/entitlement; an unknown agent and an agent in another org are the SAME 404 agent_not_found). Mints a key scoped to EXACTLY ['gateway'], bound to agent_id and, when given, session_id (the gateway conversation id), with a fixed 24h expiry matching the goal contract's sliding 24h TTL. mnemom agent mints one of these per launched session instead of handing the launched session the owner's own key (MNE-8245), so a session can never call owner-only mnemom-api routes. A session key, or any other gateway-only key, is refused here with 403 session_credential_forbidden — a session can never mint itself a broader key. The minted key's user_id is the caller, so it revokes through the existing DELETE /v1/api-keys/{key_id}.

post/agents/{agent_id}/session-keys

Request

  • Base URL: https://api.mnemom.ai/v1
  • URL: https://api.mnemom.ai/v1/agents/{agent_id}/session-keys
  • Auth: one of:
    • HTTP bearer
    • API key in header X-Mnemom-Api-Key
    • API key in cookie mnemom_session

Path parameters

agent_idstring required

The agent record id (agents.id) to bind the key to.

Query parameters

org_idstring

Target organization (defaults to the caller's primary org).

Request body

session_idstring

The gateway conversation/session id to bind the key to, if known at mint time.

Response

The minted key. key is the cleartext secret — returned once, never again.

key_idstring required
keystring required

The cleartext key — shown once.

key_prefixstring required
scopesstring[] required

Always exactly ['gateway'].

kind'session' required
agent_idstring required
session_idstring nullable required
expires_atstring date-time required
created_atstring date-time required

Changes

No recorded changes to this operation across all 1 revision of this API.