ROroarkhq
Me

Create a personal credential

Changed on

Mints a credential that acts as you, for a CLI or an automation. The key value is returned exactly once, in the key field: capture it now, it is unreadable afterwards. Requires a personal credential (a project API key is refused) and admin on the project the credential defaults to. The new credential can never exceed the one that created it: not in scope, not in permissions, and not in lifetime. Omit a field to copy it from the calling credential.

post/v1/me/api-keys

Request

  • Base URL
    https://api.roark.ai
  • URL
    https://api.roark.ai/v1/me/api-keys
  • Auth
    HTTP bearer

Request body

namestring required

A label you will recognise later. It is the only thing that tells two credentials apart in the list you revoke from.

projectIdstring

Project the credential assumes when a request sends no X-Roark-Project-Id header. Defaults to the calling credential's own default project. You must be an admin of whichever project is used.

scopesstring[]

Coarse tier. Defaults to the calling credential's own tier, and can never exceed it: a READ credential cannot mint a WRITE one.

permissionsstring[]

Granular 'resource:action' permissions. Defaults to the calling credential's own set, and can never exceed it. A ceiling, not an entitlement: the holder still only reaches what their project membership allows.

expiresAtstring date-time

ISO 8601 expiry. Defaults to the calling credential's own expiry (no expiry, for a roark auth login credential) and may not outlive it, so a short-lived connector credential cannot mint a permanent one.

Example request

{
  "name": "CI deploy gate",
  "scopes": [
    "READ"
  ],
  "permissions": [
    "call:read",
    "metric:read"
  ],
  "expiresAt": "2026-12-31T23:59:59.000Z"
}

Response

The created credential, with its key value (returned only here)

Example response

{
  "data": {
    "id": "7c6d5e4f-3a2b-4109-8765-4f3e2d1c0b9a",
    "name": "CI deploy gate",
    "createdAt": "2026-10-05T09:30:00.000Z",
    "lastUsedAt": null,
    "expiresAt": null,
    "status": "ACTIVE",
    "organizationId": "9f8e7d6c-5b4a-4312-9081-7f6e5d4c3b2a",
    "defaultProjectId": "1a2b3c4d-5e6f-4701-8293-a4b5c6d7e8f9",
    "scopes": [
      "READ"
    ],
    "permissions": [
      "call:read",
      "metric:read"
    ],
    "key": "roark0f1e2d3c4b5a69788796a5b4c3d2e1f09182"
  }
}

Changes

  • e7b6b5cc7fa6Revision changes
    • breaking

      the response's property type changed from no type to object for status

    • info

      removed from the response property allOf list for the response status

    • info

      added the required property / to the response with the status

    • info

      added the required property / to the response with the status

    • info

      added the required property / to the response with the status

    • info

      added the required property / to the response with the status

    • info

      added the required property / to the response with the status

    • info

      added the required property / to the response with the status

    • info

      added the required property / to the response with the status

    • info

      added the required property / to the response with the status

    • info

      added the required property / to the response with the status

    • info

      added the required property / to the response with the status

  • a410c3d1543cRevision changes
    • info

      endpoint added