Create a scoped API key

Requested scopes must be workspace scopes the caller itself holds, or one of the grant bundles all, all-read, all-write, which are recorded by name and expanded at use time against the grant catalogue minus operator-only scopes. Operator and wildcard scopes are not grantable here; see POST /v1/operator/machine-credentials.