Create API key
Creates a new API key. The plaintext key is only returned once - store it securely!
Authorizations
MeshQu API key passed as a bearer token: Authorization: Bearer mqu_…. Mint one in the console (Settings → API keys).
Tenant UUID for multi-tenant isolation. Required on authenticated routes. A missing or non-UUID value returns 400 MISSING_TENANT_ID or INVALID_TENANT_ID before API-key authentication.
Body
Human-readable name for the key
1 - 100Permission scopes. Defaults to policies:read, decisions:evaluate, decisions:read. When the caller is an API key, every scope of the key to be minted, the default set included when this is omitted, must be one the calling key holds, else 403 API_KEY_SCOPE_ESCALATION (details.exceeding_scopes). A human session caller is not bounded this way.
policies:read, policies:write, decisions:evaluate, decisions:read, decisions:write, alerts:read, alerts:write, audit:read, audit:admin, api-keys:admin, members:read, members:write, authoring:capability, run:orchestrate Role of the new key. Defaults to admin with MESHQU_RBAC_V2 off, viewer with it on. When the caller is an API key, the role, the default included when this is omitted, must be one its own role may mint, else 403 API_KEY_ROLE_ESCALATION (details.requested_role, details.minter_role): admin may mint any role; operator may mint operator or viewer; auditor may mint auditor or viewer; viewer may mint viewer. A human session caller is not bounded this way.
admin, operator, auditor, viewer Optional expiration time (ISO 8601)