Authentication
Send an API key as a bearer token. The key must carry the apikeys.manage permission; a key without it is refused with 403, not 404.
Where your organisation id goes
This endpoint takes org_id as a field in the JSON body.
Your organisation id is on the API keys screen in your dashboard, beside the key itself. It is the same id in every call you make.
Try it
Replace anything in angle brackets with your own values, and the key placeholder with a key from your dashboard.
curl -X POST https://api.zinndigital.com/v1/api-keys \
-H "Authorization: Bearer zdk_live_…" \
-H "Content-Type: application/json" \
-d '{ "name": <string> }'Signed in? The API console in your dashboard fills in your real organisation id and your own key, and runs the request against the live API so you can see the actual response. Open this endpoint in the API console
Details
Mints a new per-org API key and returns the full `zdk_…` token **once** — only its hash is stored, so a lost token is replaced, never recovered. The requested `scopes` must be permissions the caller already holds in the target org; asking for one you do not hold is a `403` (a key can never out-scope its creator). Send an `Idempotency-Key` so a retry after a lost response returns the same token rather than orphaning a key. Requires `apikeys.manage`.
Parameters
| Name | Type | Required | What it is |
|---|---|---|---|
Idempotency-Key (header) | string | No | Client-generated key that makes an unsafe request replay-safe: the server stores the first response and returns it verbatim for repeats. |
Request body
| Name | Type | Required | What it is |
|---|---|---|---|
name | string | Yes | — |
scopes | string[] | No | RBAC permission keys to grant. Each must be a permission the caller holds in the target org (a key can never out-scope its creator); an unheld scope is a `403`, an unknown one a… |
sandbox | boolean | No | Mint a sandbox (test-mode) key. Defaults to false. |
org_id | Uuid | null | No | The organization the key belongs to. Defaults to the caller's org; the caller must hold `apikeys.manage` in the target org. |
Response
| Name | Type | Required | What it is |
|---|---|---|---|
id | Uuid | Yes | UUIDv7 identifier — sortable by creation time (docs/02 §8). |
name | string | Yes | — |
prefix | string | Yes | The key's public lookup id (the middle segment of the token). |
scopes | string[] | Yes | The RBAC permission keys this key may exercise. |
sandbox | boolean | Yes | A sandbox (test-mode) key suppresses billing + provisioning (docs/09 §2). |
last_used_at | object | No | When the key last authenticated a request; null if never used. |
revoked_at | object | No | Always null on a listed/fetched key — revoked keys are not returned. |
created_at | string | Yes | — |
token | string | Yes | The full `zdk_<mode>_<prefix>_<secret>` token. Shown **once, here only** — store it now; it cannot be retrieved again, only replaced. |
Errors this endpoint can return
401 · 403 · 409 · 422 · 429