Skip to main content
POST
Create API key

Authorizations

Authorization
string
header
required

MeshQu API key passed as a bearer token: Authorization: Bearer mqu_…. Mint one in the console (Settings → API keys).

X-MeshQu-Tenant-Id
string
header
required

Tenant UUID for multi-tenant isolation. Required on all authenticated routes — validated before authentication (middleware/tenant.ts), so a missing or non-UUID header returns 400 (MISSING_TENANT_ID / INVALID_TENANT_ID) before the API key is checked.

Body

application/json
name
string
required

Human-readable name for the key

Required string length: 1 - 100
scopes
enum<string>[]

Permission scopes. Defaults to read + evaluate. The operator-level tenants:provision scope is not grantable here (granted out-of-band only).

Available options:
policies:read,
policies:write,
decisions:evaluate,
decisions:read,
decisions:write,
alerts:read,
alerts:write,
audit:read,
audit:admin,
api-keys:admin,
members:read,
members:write
role
enum<string>
Available options:
admin,
operator,
auditor,
viewer
expires_at
string<date-time>

Optional expiration time (ISO 8601)

Response

Default Response

key
object
required
plaintext_key
string
required

Full API key - only shown once. Store securely! Format: mqu_<43 chars base64url>