Create Project Key

Create a Project Key with API credentials and optional Kafka access.

Returns a credential file (JSON) with plaintext secrets. This is a one-time delivery - secrets are masked in all subsequent responses. Optionally creates a Kafka user with SCRAM credentials, K8s proxy, and ACLs.

Request body

namestring required

Human-readable name for this Project Key

descriptionstring nullable

Optional description (HTML sanitized)

role_idsstring[] nullable

Role IDs to assign. Mutually exclusive with permission_ids.

permission_idsstring[] nullable

Permission IDs to assign directly. Mutually exclusive with role_ids.

tool_profile'full' | 'read-only' | 'agent-operator' | 'infra-admin'

allowed_toolsstring[] nullable

MCP tool whitelist. If set, overrides profile and block list.

blocked_toolsstring[] nullable

MCP tool blacklist. Removes tools even if profile allows them.

agentic_enabledboolean

When true, atomically seeds agentic_secret_blob on the new PK row from the credential file produced during creation. The PK is then immediately usable as the auth blob behind the Streamkap MCP. Requires API credentials (role_ids or permission_ids) - rejected with 400 on Kafka-only PKs since there is no API credential to seed. Audit-logged with action=enable. Post-creation toggling goes through POST /project-keys/{id}/enable-agentic or /disable-agentic.

Response

Successful Response

typestring

project_key_idstring required

projectobject required

kafka_aclsobject[]