STstreamkap
Project Keys

Create Project Key

Changed on

Create a Project Key with API credentials and optional Kafka access.

Returns a credential file (JSON) with plaintext secrets. This is a one-time delivery - secrets are masked in all subsequent responses. Optionally creates a Kafka user with SCRAM credentials, K8s proxy, and ACLs.

post/project-keys

Request

Request body

namestring required

Human-readable name for this Project Key

descriptionstring nullable

Optional description (HTML sanitized)

role_idsstring[] nullable

Role IDs to assign. Mutually exclusive with permission_ids.

permission_idsstring[] nullable

Permission IDs to assign directly. Mutually exclusive with role_ids.

tool_profile'full' | 'read-only' | 'agent-operator' | 'infra-admin'
allowed_toolsstring[] nullable

MCP tool whitelist. If set, overrides profile and block list.

blocked_toolsstring[] nullable

MCP tool blacklist. Removes tools even if profile allows them.

agentic_enabledboolean

When true, atomically seeds agentic_secret_blob on the new PK row from the credential file produced during creation. The PK is then immediately usable as the auth blob behind the Streamkap MCP. Requires API credentials (role_ids or permission_ids) - rejected with 400 on Kafka-only PKs since there is no API credential to seed. Audit-logged with action=enable. Post-creation toggling goes through POST /project-keys/{id}/enable-agentic or /disable-agentic.

Response

Successful Response

typestring
project_key_idstring required
projectobject required
kafka_aclsobject[]
tool_profile'full' | 'read-only' | 'agent-operator' | 'infra-admin'
allowed_toolsstring[] nullable
blocked_toolsstring[] nullable
created_atstring date-time required
created_bystring nullable

Changes