Sign in
API Keys

Create key

Creates a new API key with an optional expiry. The full key value is only returned once in the response.

post/v1/api-keys

Request body

namestring required
expiresIninteger

Days until expiry

scope'full' | 'profiles'

'full' grants access to all profiles (default), 'profiles' restricts to specific profiles

profileIdsstring[]

Profile IDs this key can access. Required when scope is 'profiles'.

permission'read-write' | 'read'

'read-write' allows all operations (default), 'read' restricts to GET requests only

disabledResourceGroupsstring[]

Resource groups to DISABLE on this key (opt-out denylist). Omit for a legacy full-access key. A key with any group disabled mints with the zrk_ prefix, gets 403 with code=insufficient_permissions and required_group on operations in disabled groups (each operation's group is published as x-resource-group), and can never manage API keys, invites, or member identity. With 'messages' disabled, the key cannot read or send private messages through any API surface and cannot create or edit a webhook subscription broader than itself. Subscriptions that already exist are governed by their own disabledResourceGroups, not by this key's. OAuth connector tokens resolve against the same registry, but their groups are not settable yet.

Response

Created

messagestring

Changes

No recorded changes to this endpoint across all 26 revisions of this API.