SUsurrealdb

POST /api/v1/{context_id}/keys

Changed on

Mint a new data-plane API key bound to the caller's own principal. The optional grants body only attenuates (never widens) the caller's effective grants. Gated by the Context's allow_self_service_keys flag; rejects legacy / delegated callers.

Request

Path parameters

context_idstring required

Spectron context id

Query parameters

ttlSecondsinteger nullable

Seconds until the minted/rotated key expires. Omitted on create = "never expires" (subject to the Context's max_token_ttl_seconds cap). Omitted on rotate = inherit the key's current expiry.

Request body

grantsobject nullable

Optional attenuating per-verb grant map. Every requested pattern must be ⊆ the caller's effective region for that verb (fail-closed); an out-of-range pattern returns 400. Absent ⇒ inherit principal grants.

namestring nullable

Optional human-readable name (unique per Context). Auto-derived from the minted key id when absent.

Response

Plaintext key returned once

idstring required

The key's stable record-id key (survives rotation).

keystring required

The full bearer key (sp-{id}-{secret}). Send as Authorization: Bearer ….

validUntilstring date-time nullable

Mint-time expiry. Absent ⇒ no expiry.

Changes