Skip to main content
POST
Create API key

Authorizations

Authorization
string
header
required

MeshQu API key passed as a bearer token: Authorization: Bearer mqu_…. Mint one in the console (Settings → API keys).

X-MeshQu-Tenant-Id
string
header
required

Tenant UUID for multi-tenant isolation. Required on authenticated routes. A missing or non-UUID value returns 400 MISSING_TENANT_ID or INVALID_TENANT_ID before API-key authentication.

Body

application/json
name
string
required

Human-readable name for the key

Required string length: 1 - 100
scopes
enum<string>[]

Permission scopes. Defaults to policies:read, decisions:evaluate, decisions:read. When the caller is an API key, every scope of the key to be minted, the default set included when this is omitted, must be one the calling key holds, else 403 API_KEY_SCOPE_ESCALATION (details.exceeding_scopes). A human session caller is not bounded this way.

Available options:
policies:read,
policies:write,
decisions:evaluate,
decisions:read,
decisions:write,
alerts:read,
alerts:write,
audit:read,
audit:admin,
api-keys:admin,
members:read,
members:write,
authoring:capability,
run:orchestrate
role
enum<string>

Role of the new key. Defaults to admin with MESHQU_RBAC_V2 off, viewer with it on. When the caller is an API key, the role, the default included when this is omitted, must be one its own role may mint, else 403 API_KEY_ROLE_ESCALATION (details.requested_role, details.minter_role): admin may mint any role; operator may mint operator or viewer; auditor may mint auditor or viewer; viewer may mint viewer. A human session caller is not bounded this way.

Available options:
admin,
operator,
auditor,
viewer
expires_at
string<date-time>

Optional expiration time (ISO 8601)

Response

Default Response

key
object
required
plaintext_key
string
required

Full API key - only shown once. Store securely! Format: mqu_<43 chars base64url>