---
title: "Issue a self-serve sandbox key, shown once"
method: POST
path: "/api/v1/sandbox/keys"
tags: ["Keys"]
---

# Issue a self-serve sandbox key, shown once

`POST /api/v1/sandbox/keys`

## Request

- Base URL: `https://api.riskrouter.eu`
- URL: `https://api.riskrouter.eu/api/v1/sandbox/keys`
- Auth: none declared

No account and nothing about the caller is stored. The key is returned once; only its SHA-256 digest is kept. Limits are enforced by the database: 50 recorded entries per key per day and a shared hourly allowance of new keys. Sandbox only.

## Request body

- object
  - `acknowledge_permanent` true, required: Entries recorded with the key are written to an append-only ledger and can never be deleted. Must be the boolean true.
  - `src` string: Optional campaign tag of the link the visitor arrived through. A malformed tag is dropped, never refused.

## Response `201`

Issued. The key appears in this response and nowhere else.

- SandboxKey
  - `ok` boolean
  - `key` string
  - `key_prefix` string
  - `environment` 'sandbox'
  - `distributor` object
    - `id` string, uuid
    - `slug` string
  - `warning` string
  - `limits` object
    - `ledger_entries_per_day` integer
    - `production` string
  - `next_steps` object[]
    - `step` string
    - `command` string
    - `url` string
  - `generated_at` string, date-time

## Other responses

- `400`: Every error carries the same envelope with a stable code.
- `413`: Every error carries the same envelope with a stable code.
- `429`: Every error carries the same envelope with a stable code.
- `503`: Every error carries the same envelope with a stable code.

---

[API](https://skmtc.dev/riskrouter/apis/riskrouter-api.md) · [All operations](https://skmtc.dev/riskrouter/apis/riskrouter-api/llms.txt) · [OpenAPI document](https://skmtc.dev/riskrouter/apis/riskrouter-api/revisions/5fee45dc6d1f?raw)