---
title: "Create an Endpoint API Key"
method: POST
path: "/v2.0/endpoints/{endpointId}/apikeys"
tags: ["Endpoints"]
---

# Create an Endpoint API Key

`POST /v2.0/endpoints/{endpointId}/apikeys`

Generates a new API key for the given Webhook/Generic Endpoint. Returns the plaintext key in the response body exactly once — the server stores only the SHA-256 hash and a masked preview, and the plaintext is never retrievable again.

## Path parameters

- `endpointId` string, required

## Headers

- `Accept` 'application/json' | 'application/hal+json' | 'application/xml' | 'text/xml' | 'text/csv'

## Request body

- object — Request body for creating a new Endpoint API Key.
  - `name` string, required — Customer-provided display name for the key.

## Response `201`

The Endpoint API Key was created. The plaintext `key` is returned exactly once.

- object — Response body returned exactly once at creation time. The plaintext `key` is never persisted and never returned by any other route.
  - `_id` string
  - `name` string — Customer-provided display name for the key.
  - `keyPreview` string — Masked preview of the plaintext key (first 4 chars + masked middle + last 4 chars). Captured at generation time.
  - `createdAt` integer — Unix-timestamp
  - `key` string, required — The plaintext API key. Returned exactly once. The caller must persist it client-side — the server will not show it again.

## Other responses

- `400` — Bad request - missing or invalid `name`.
- `401` — The request has not been applied because it lacks valid authentication credentials for the target resource.
- `402` — Upgrade your Plan to increase your Quota.
- `403` — The user lacks permission to update this Endpoint.
- `404` — Endpoint not found.
- `405` — The method received in the request-line is known by the origin server but not supported by the target resource.
- `409` — Maximum number of API keys for this Endpoint exceeded.
- `413` — The request entity is larger than limits defined by server.
- `500` — The server encountered an unexpected condition that prevented it from fulfilling the request.
- `501` — The server does not support the functionality required to fulfill the request.
- `502` — The server, while acting as a gateway or proxy, received an invalid response from an inbound server it accessed while attempting to fulfill the request.
- `503` — The server is not ready to handle the request.
- `504` — The server, while acting as a gateway or proxy, did not receive a timely response from an upstream server it needed to access in order to complete the request.

---

[API](https://skmtc.net/cognigy/apis/simulator-openapi-rest-ful-api-reference.md) · [All operations](https://skmtc.net/cognigy/apis/simulator-openapi-rest-ful-api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/cognigy/simulator-openapi-rest-ful-api-reference/revisions/85b2872bdfb7/schema)