> ## Documentation Index
> Fetch the complete documentation index at: https://docs.meshqu.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Create API key

> Creates a new API key. The plaintext key is only returned once - store it securely!



## OpenAPI

````yaml /api/openapi.json post /v1/admin/api-keys
openapi: 3.1.0
info:
  title: MeshQu API
  description: >-
    Governance infrastructure for policy-aware AI decisions. MeshQu does not run
    tools. It governs decisions about them.
  version: 1.9.0
  contact:
    name: MeshQu Support
    email: support@meshqu.com
  license:
    name: Proprietary
servers:
  - url: https://api.meshqu.com
    description: Deployed environment
security:
  - apiKey: []
    tenantId: []
tags:
  - name: Operations
    description: Health, readiness, metrics, and signing keys
  - name: Policies
    description: Policy management
  - name: Policy Groups
    description: Policy group management
  - name: Decisions
    description: Policy evaluation and recording
  - name: Chains
    description: Decision chain verification and sealing
  - name: Receipts
    description: Public receipt and bundle retrieval
  - name: Forms
    description: Attestation forms and public submission
  - name: Alerts
    description: Alert management and webhooks
  - name: Audit
    description: Audit log retrieval and verification
  - name: API Keys
    description: API key administration
  - name: Admin
    description: Tenant and platform administration
  - name: Dashboard
    description: Console dashboard data
  - name: Metrics
    description: Decision and overview metrics
  - name: Fields
    description: Field catalogue
  - name: Settings
    description: Tenant settings
  - name: Rule Creation Logs
    description: Rule authoring telemetry
paths:
  /v1/admin/api-keys:
    post:
      tags:
        - Admin
      summary: Create API key
      description: >-
        Creates a new API key. The plaintext key is only returned once - store
        it securely!
      operationId: postV1AdminApiKeys
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                name:
                  minLength: 1
                  maxLength: 100
                  description: Human-readable name for the key
                  type: string
                scopes:
                  description: >-
                    Permission scopes. Defaults to read + evaluate. The
                    operator-level tenants:provision scope is not grantable here
                    (granted out-of-band only).
                  type: array
                  items:
                    type: string
                    enum:
                      - policies:read
                      - policies:write
                      - decisions:evaluate
                      - decisions:read
                      - decisions:write
                      - alerts:read
                      - alerts:write
                      - audit:read
                      - audit:admin
                      - api-keys:admin
                      - members:read
                      - members:write
                role:
                  type: string
                  enum:
                    - admin
                    - operator
                    - auditor
                    - viewer
                expires_at:
                  format: date-time
                  description: Optional expiration time (ISO 8601)
                  type: string
              required:
                - name
      responses:
        '201':
          description: Default Response
          content:
            application/json:
              schema:
                type: object
                properties:
                  key:
                    type: object
                    properties:
                      id:
                        format: uuid
                        type: string
                      tenant_id:
                        format: uuid
                        type: string
                      name:
                        type: string
                      key_preview:
                        description: Key prefix + last 4 chars (e.g., "mqu_...x7Kf")
                        type: string
                      scopes:
                        type: array
                        items:
                          type: string
                          enum:
                            - policies:read
                            - policies:write
                            - decisions:evaluate
                            - decisions:read
                            - decisions:write
                            - alerts:read
                            - alerts:write
                            - audit:read
                            - audit:admin
                            - api-keys:admin
                            - members:read
                            - members:write
                            - tenants:provision
                      role:
                        type: string
                        enum:
                          - admin
                          - operator
                          - auditor
                          - viewer
                      expires_at:
                        anyOf:
                          - format: date-time
                            type: string
                          - type: 'null'
                      last_used_at:
                        anyOf:
                          - format: date-time
                            type: string
                          - type: 'null'
                      is_active:
                        type: boolean
                      created_at:
                        format: date-time
                        type: string
                      created_by:
                        anyOf:
                          - type: string
                          - type: 'null'
                      revoked_at:
                        anyOf:
                          - format: date-time
                            type: string
                          - type: 'null'
                      revoked_by:
                        anyOf:
                          - type: string
                          - type: 'null'
                    required:
                      - id
                      - tenant_id
                      - name
                      - key_preview
                      - scopes
                      - role
                      - expires_at
                      - last_used_at
                      - is_active
                      - created_at
                      - created_by
                      - revoked_at
                      - revoked_by
                  plaintext_key:
                    description: >-
                      Full API key - only shown once. Store securely! Format:
                      mqu_<43 chars base64url>
                    type: string
                required:
                  - key
                  - plaintext_key
        '400':
          description: Default Response
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: object
                    properties:
                      code:
                        description: Error code
                        type: string
                      message:
                        description: Human-readable message
                        type: string
                      details:
                        description: Additional error details
                    required:
                      - code
                      - message
                  correlation_id:
                    description: Request correlation ID
                    type: string
                required:
                  - error
        '403':
          description: Default Response
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: object
                    properties:
                      code:
                        description: Error code
                        type: string
                      message:
                        description: Human-readable message
                        type: string
                      details:
                        description: Additional error details
                    required:
                      - code
                      - message
                  correlation_id:
                    description: Request correlation ID
                    type: string
                required:
                  - error
components:
  securitySchemes:
    apiKey:
      type: http
      scheme: bearer
      bearerFormat: mqu_<token>
      description: >-
        MeshQu API key passed as a bearer token: `Authorization: Bearer mqu_…`.
        Mint one in the console (Settings → API keys).
    tenantId:
      type: apiKey
      name: X-MeshQu-Tenant-Id
      in: header
      description: >-
        Tenant UUID for multi-tenant isolation. Required on all authenticated
        routes — validated before authentication (middleware/tenant.ts), so a
        missing or non-UUID header returns 400 (MISSING_TENANT_ID /
        INVALID_TENANT_ID) before the API key is checked.

````