---
title: "Create toolkit"
method: POST
path: "/toolkits"
tags: ["Toolkits"]
---

# Create toolkit

`POST /toolkits`

Create a toolkit and issue its first API key.

The plaintext key (`jntc_live_…`) is returned **once** in `api_key` and is
never retrievable again. Optional `credential_ids` bind existing credentials
at creation time; each inline bind emits a ``no_permission_rules`` warning
because the broker denies by default until rules are added.

## Request body

- ToolkitCreateRequest — Create a new toolkit.
  - `active` boolean
  - `credential_ids` string[], nullable
  - `description` string, nullable
  - `name` string, required

## Response `201`

Successful Response

- ToolkitCreateResponse — Create response: toolkit + api_key shown once.
  - `api_key` string, required
  - `toolkit` ToolkitResponse, required — Toolkit response.
    - `active` boolean, required
    - `apis` ServedApiRef[] — Distinct APIs served by this toolkit's credential bindings that are visible to the caller, sorted by vendor/name/version. NULL api_name/api_version mean the credential covers all names/versions for the vendor. Empty when no visible credentials are bound.
      - `api_name` string, nullable
      - `api_vendor` string, required
      - `api_version` string, nullable
    - `created_at` string, date-time, required
    - `created_by` string, nullable
    - `credential_count` integer, required
    - `description` string, nullable
    - `key_count` integer, required
    - `name` string, required
    - `toolkit_id` string, required
    - `updated_at` string, date-time, nullable
  - `warnings` BindingWarningSchema[] — Non-fatal signals about the create — e.g. inline-bound credentials that landed with zero permission rules (broker denies by default).
    - `code` string, required — Stable machine-readable warning code.
    - `credential_id` string, nullable — Credential the warning applies to; null when the whole binding is meant.
    - `message` string, required — Human-readable explanation with a recovery pointer.

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `403` — Forbidden
- `422` — Unprocessable Entity
- `500` — Internal Server Error
- `503` — Service Unavailable

---

[API](https://skmtc.net/jentic/apis/jentic-control-plane-api.md) · [All operations](https://skmtc.net/jentic/apis/jentic-control-plane-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/jentic/jentic-control-plane-api/revisions/7cc96b2f28d4/schema)