Create Api Credential

Create a server-to-server credential for the acting entity (or an organization the caller can edit). The response includes client_secret exactly once — secrets are hashed at rest and cannot be re-read; use rotate to obtain a new one. Two ways to hold a token: exchange the secret at POST /oauth/token (grant_type=client_credentials, 15-day tokens), or mint a long-lived token in the UI with POST /api-credentials/{id}/tokens (show-once token string, no secret needed). Either way tokens act strictly for the owning entity at edit-level authority.