Mint a data-scoped API key (keys:admin)

POST 
/api/v1/keys

Required scope: keys:admin (a privileged scope that is NOT part of the data-scope vocabulary; it is granted only through the dedicated admin mint in the Traceable UI and can never be self-granted through this API). Mints a pk_live_* key holding DATA scopes only; requesting keys:admin in the body fails validation. The response is the ONLY place rawKey and signingSecret appear (reveal-once); a retried request with the same Idempotency-Key returns the SAME key for 1 hour instead of minting twice. Max 10 active keys per company.

Request

Responses

201

Reveal-once key material (never retrievable again).

400

400 — INVALID_JSON, VALIDATION_ERROR, or IDEMPOTENCY_KEY_REQUIRED.

401

401 — INVALID_SIGNATURE or SIGNING_NOT_CONFIGURED (or bearer auth failure).

403

403 — missing scope (FORBIDDEN_SCOPE) or module (FORBIDDEN_MODULE).

422

MINT_REJECTED — cap reached or invalid grant.

429

429 — RATE_LIMITED (per-key limit, reads and writes alike; fails closed, so a limiter outage also returns 429). A limiter-down 429 is deliberately indistinguishable from a quota 429. Carries Retry-After (seconds).

Response Headers

Retry-After

Seconds to wait before retrying (429 only).

RateLimit-Limit

Per-minute request ceiling for this key's tier.

RateLimit-Remaining

Requests left in the current window (floored at 0).

RateLimit-Reset

Seconds until the window resets.

503

503 — the API is not enabled on this environment (FEATURE_DISABLED).