---
title: "Create an API account"
method: POST
path: "/apiaccounts"
tags: ["API account management"]
---

# Create an API account

`POST /apiaccounts`

Create a new API account from provided parameters. If a token need to be generated, it will be presented only once in the answer.

## Request body

- ApiAccountNew
  - `id` string — An optional ID for that account. It needs to match [a-zA-Z0-9_-]+
  - `name` string — Human readable name of the API account
  - `description` string — One line API account description
  - `status` 'enabled' | 'disabled' — Status of that API account
  - `generateToken` boolean — Optionally specify if the token need to be generated (default true)
  - `expirationPolicy` 'never' | 'datetime' — Optionally specify the expiration policy of the API account. Default: never
  - `expirationDate` string, rfc3339 — Optional expiration date of the API account
  - `tenants` union — a comma separated list of tenant IDs (validated with non empty alpha-num and hyphen) allowed for that account, or special value "\*" / "-".
    - '*'
    - '-'
    - string
  - `authorizationType` 'rw' | 'ro' | 'acl' — Authorization type for that account: - ro: read-only (GET) access to all APIs - rw: read (GET) and write (other verbs) access to all APIs - acl: access control list based permission for API (need api-authorization plugin)
  - `acl` object[] — in case of ACL authorization type, the actual ACL
    - `path` string — API path managed by that access control
    - `actions` string[] — List of HTTP verb allowed

## Response `200`

Information about request

- object
  - `result` 'success' | 'error', required — Result of the request
  - `id` string, uuid, required — ID of the created account
  - `action` 'createAccount', required — The id of the action
  - `data` object, required
    - `accounts` ApiAccount[], required
      - `id` string, uuid — API account id
      - `name` string — Human readable name of the API account
      - `description` string — One line API account description
      - `status` 'enabled' | 'disabled' — Status of that API account
      - `creationDate` string, rfc3339 — Creation date of the API account
      - `expirationPolicy` 'never' | 'datetime' — Expiration policy of the API account (not the token)
      - `expirationDate` string, rfc3339 — Optional expiration date of the API account
      - `tokenState` 'generated' | 'missing' — State of the token for that account. An account with token state 'missing' means that there is no token for that account.
      - `token` string — The token secret. It will be returned only once when a new token is generated.
      - `tokenGenerationDate` string, rfc3339 — Optional generation date for the token when tokenState is 'generated'
      - `tenants` union — a comma separated list of tenant IDs (validated with non empty alpha-num and hyphen) allowed for that account, or special value "\*" / "-".
        - '*'
        - '-'
        - string
      - `authorizationType` 'rw' | 'ro' | 'acl' — Authorization type for that account: - ro: read-only (GET) access to all APIs - rw: read (GET) and write (other verbs) access to all APIs - acl: access control list based permission for API (need api-authorization plugin)
      - `acl` object[] — in case of ACL authorization type, the actual ACL
        - `path` string — API path managed by that access control
        - `verb` string — HTTP verb allowed

---

[API](https://skmtc.net/rudder/apis/rudder-api.md) · [All operations](https://skmtc.net/rudder/apis/rudder-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/rudder/rudder-api/revisions/eab988254fba/schema)