v1

latestOpenAPI 3.1.02026-07-263971,2281.1 MB

RBACService

API Key management

post/textql.rpc.public.rbac.RBACService/CreateApiKey

Headers

Connect-Protocol-Version1 required

Define the version of the Connect protocol

Connect-Timeout-Msnumber

Define the timeout, in ms

Request body

expirySecondsinteger nullable

assumedRolesstring[]

Role IDs (UUIDs) to scope the new API key to. The service validates that each ID exists in the caller's org. Non-admin callers may only specify roles they already hold; assumed-role API key callers may only specify a subset of their current assumed roles.

inheritAllRolesboolean nullable

When true, the API key inherits all of the creating member's roles (no assumed-role scoping). Callers must set this explicitly when assumed_roles is empty; otherwise the request is rejected to prevent accidentally creating over-privileged keys.

namestring nullable

Optional display name for the API key.

targetMemberIdstring nullable

Optional owner override for the new API key. If unset, the API key is created for the calling member. If set, the API key is created for this member ID (target principal): service-account targets require the caller to hold organization:write; human targets require api_access_key:delegate, and the key is bounded by the target member's roles with superadmin elevation always suppressed.

clientIdstring nullable

Optional client metadata stored on the API key as client_id. Prefer a JSON object string when using structured client attributes.

suppressSuperadminboolean

When true, requests authenticated with this key skip the @textql.com-email superadmin elevation branch. Only meaningful when paired with assumed_roles so a textql admin can preview a role's experience without superadmin permissions bleeding through.

Response

Success

apiKeySecretstring

apiKeyHashstring

Deprecated compatibility alias for api_key_secret. This field contains the same one-time bearer credential; it is not the hash stored at rest.

Example response

{
  "apiKey": {
    "createdAt": "2023-01-15T01:30:15.01Z",
    "expiresAt": "2023-01-15T01:30:15.01Z",
    "revokedAt": "2023-01-15T01:30:15.01Z"
  }
}