---
title: "Apply a kit: mint an explicitly scoped platform API key (and optionally a disabled webhook endpoint)."
method: POST
path: "/v1/kits"
tags: ["Kits"]
---

# Apply a kit: mint an explicitly scoped platform API key (and optionally a disabled webhook endpoint).

`POST /v1/kits`

## Request

- Base URL: `https://signaledi.com/api`
- URL: `https://signaledi.com/api/v1/kits`
- Auth: one of:
  - API key in cookie `authjs.session-token`
  - API key in cookie `__Secure-authjs.session-token`

Signed-in dashboard session only. Bearer and marketplace credentials cannot issue or chain API keys.

## Request body

- object
  - `kitId` string, required
  - `webhookUrl` string: Optional HTTPS callback; creates a DISABLED webhook endpoint.
  - `connectionAccess` 'none' | 'read' | 'certification' | 'production': Explicit connection grant for the new key. Production is never added by default.
  - `environment` 'LAB' | 'CERTIFICATION' | 'PRODUCTION': Exact lane for the issued key and quickstart. Certification requires an eligible partner connection; Production requires the tenant's current go-live entitlement.
  - `webhookEnvironment` 'CERTIFICATION' | 'PRODUCTION': Lane for the optional disabled persistent webhook endpoint. Lab uses the signed one-shot webhook probe. When supplied, this value must match environment.

## Response `201`

Kit applied; API key minted (shown once).

- object
  - `ok` true, required
  - `kit` object
  - `apiKey` object
  - `webhookEndpoint` object, nullable
  - `webhookEndpointActive` boolean
  - `environment` 'LAB' | 'CERTIFICATION' | 'PRODUCTION'

## Other responses

- `400`: Request body failed validation (`code` e.g. VALIDATION_ERROR, NO_WORKSPACE, BATCH_TOO_LARGE).
- `401`: Missing or invalid API key (`code` AUTH_UNAUTHORIZED).
- `402`: Production kit creation is unavailable because the tenant is not currently entitled for Production (`code` LIVE_API_KEY_CHECKOUT_REQUIRED).
- `403`: Bearer or marketplace credentials cannot issue keys (`code` API_KEY_ISSUANCE_SESSION_REQUIRED) or the session role may not issue keys (AUTH_FORBIDDEN).
- `404`: Resource not found, or the /v1 platform is disabled (`code` NOT_FOUND / PARTNER_NOT_FOUND / WORKSPACE_NOT_FOUND).
- `409`: Certification kit requested before any partner connection is certification-eligible (`code` CERTIFICATION_NOT_OPEN).
- `429`: Rate limit exceeded (`code` RATE_LIMITED).
- `500`: Unexpected server error (`code` e.g. PARSE_FAILED, VALIDATE_FAILED, OUTBOUND_FAILED, INBOUND_FAILED, BATCH_FAILED, TRANSACTIONS_FAILED, DOCUMENT_RECEIPT_FAILED, DOCUMENT_PAYLOAD_FAILED). Sanitized bodies carry an opaque `correlationId` to quote to support; internal error text is never echoed.

---

[API](https://skmtc.dev/signaledi/apis/signaledi-developer-api.md) · [All operations](https://skmtc.dev/signaledi/apis/signaledi-developer-api/llms.txt) · [OpenAPI document](https://skmtc.dev/signaledi/apis/signaledi-developer-api/revisions/9bc596644a10?raw)