---
title: "Create API Key"
method: POST
path: "/apikeys"
tags: ["Authentication/API Key (Machine 2 Machine)"]
---

# Create API Key

`POST /apikeys`

This is a limited action and will require special access to create API keys.

## Request body

- object
  - `description` string, required — This is the main description/name for the API key that should describe its purpose for tracking and understanding its intended use.
  - `reseller` string, required — This is the reseller that will limit the API key to access the resellers data set.
  - `user` string — This is the main user extension for the user account.
  - `domain` string, required — This is the main organization name. This is used to link resource to its group/tenant/organization/enterprise. ~ and * can be used alone in special cases to mean My Domain (~) and All Domains (\*).
  - `user-scope` 'Basic User' | 'Simple User' | 'Advanced User' | 'Call Center Agent' | 'Call Center Supervisor' | 'Office Manager' | 'Reseller' | 'Super User' | 'NDP' — This is the scope that will be be used to enforce permissions for this API key and access.
  - `ip-address` string — Optional IP restrictions for API to require access from matching IP or subnets. Multipe ips/subnets can be provided comma seperated
  - `readonly` 'yes' | 'no' — If enabled it will limit any get Scope to a read only verion providing only GET acces to the read actions. POST, PUT and DELETE will be rejected.
  - `can-create-keys` 'yes' | 'no' — If enabled it will allow this key to make keys for lesser scopes then itself. It will not allow creations of scopes same or higher access level.
  - `allowed-models` union — This is an optional limitation to the ability of this apikey. The default is * or all models, but can be set to a specific model or array of models allowing specific access. The "models" are linked to objects as defined in the scope definition and might have varies terminolofy from the api itself.
    - string — A string with a specific model or "*" for all.
    - string[] — An array of models.
  - `created-datetime` string, date-time — The datetime that the key was created.
  - `lastused-datetime` string, date-time, nullable — The datetime of the last time the apikey was used for API access. The timestamp is acurrate up to the hour to avoid overhead in tracking high volume requests

## Response `200`

- object
  - `description` string, required — This is the main description/name for the API key that should describe its purpose for tracking and understanding its intended use.
  - `key-id` string, required — This is the Key ID that will identify the key and allow for managment, audit tracking and monitoring.
  - `key` string — This is the key that will need to be saved securly for use in accessing the API. It will only be shown once.
  - `reseller` string, required — This is the reseller that will limit the API key to access the resellers data set.
  - `user` string — This is the main user extension for the user account.
  - `domain` string, required — This is the main organization name. This is used to link resource to its group/tenant/organization/enterprise. ~ and * can be used alone in special cases to mean My Domain (~) and All Domains (\*).
  - `user-scope` 'Basic User' | 'Simple User' | 'Advanced User' | 'Call Center Agent' | 'Call Center Supervisor' | 'Office Manager' | 'Reseller' | 'Super User' | 'NDP' — This is the scope that will be be used to enforce permissions for this API key and access.
  - `ip-address` string — Optional IP restrictions for API to require access from matching IP or subnets. Multipe ips/subnets can be provided comma seperated
  - `readonly` 'yes' | 'no' — If enabled it will limit any get Scope to a read only verion providing only GET acces to the read actions. POST, PUT and DELETE will be rejected.
  - `can-create-keys` 'yes' | 'no' — If enabled it will allow this key to make keys for lesser scopes then itself. It will not allow creations of scopes same or higher access level.
  - `allowed-models` union — This is an optional limitation to the ability of this apikey. The default is * or all models, but can be set to a specific model or array of models allowing specific access. The "models" are linked to objects as defined in the scope definition and might have varies terminolofy from the api itself.
    - string — A string with a specific model or "*" for all.
    - string[] — An array of models.
  - `created-datetime` string, date-time — The datetime that the key was created.
  - `lastused-datetime` string, date-time, nullable — The datetime of the last time the apikey was used for API access. The timestamp is acurrate up to the hour to avoid overhead in tracking high volume requests

## Other responses

- `400`
- `401`
- `403`
- `404`

---

[API](https://skmtc.net/ns-api/apis/netsapiens-api-v2.md) · [All operations](https://skmtc.net/ns-api/apis/netsapiens-api-v2/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/ns-api/netsapiens-api-v2/revisions/d37f65b5b886/schema)