---
title: "Create a sub-key (child) in the organization"
method: POST
path: "/api/v1/organizations/{id}/keys"
tags: ["Multi-tenancy"]
---

# Create a sub-key (child) in the organization

`POST /api/v1/organizations/{id}/keys`

## Request

- Base URL: `https://legal.nexusquantum.legal`
- URL: `https://legal.nexusquantum.legal/api/v1/organizations/{id}/keys`
- Auth: HTTP bearer

The master generates a sub-key for an end client. The scopes are a strict subset of the master scopes (no escalation possible). The secret is returned ONLY ONCE.

Usage is attributed to this sub-key, visible via `GET /api/v1/usage?organization_id=<orgId>` with a breakdown by `child_label`.

## Path parameters

- `id` string, uuid, required

## Request body

- object
  - `childLabel` string, required: Name of the end client, e.g. 'Despacho Vázquez'
  - `scopes` string[]
  - `expiresInDays` integer

## Response `201`

Sub-key created. The `key` field is shown only once.

- SubKeyCreated
  - `key` string: Sub-key plaintext (`nlk_…`). SHOWN ONLY ONCE. Store it securely.
  - `api_key` OrgKey
    - `id` string, uuid
    - `name` string
    - `key_prefix` string: First 12 chars (nlk_xxxxxxxx). The rest is NOT exposed.
    - `role` 'solo' | 'master' | 'child'
    - `child_label` string, nullable
    - `scopes` string[]
    - `tier` 'standard' | 'premium' | 'enterprise'
    - `rate_limit_rpm` integer
    - `active` boolean
    - `created_at` string, date-time
    - `last_used_at` string, date-time, nullable
    - `expires_at` string, date-time, nullable

## Other responses

- `403`: You are not master of this org.
- `422`: Limit of 200 sub-keys per org reached, or invalid scopes.

---

[API](https://skmtc.dev/nexusquantum/apis/nexus-legal-api.md) · [All operations](https://skmtc.dev/nexusquantum/apis/nexus-legal-api/llms.txt) · [OpenAPI document](https://skmtc.dev/nexusquantum/apis/nexus-legal-api/revisions/4084d8d4eb0b?raw)