curl --silent --show-error --fail-with-body --request POST \
--url 'https://api.computer.stateset.app/api/v1/keys' \
--header "X-API-Key: $STATESET_COMPUTER_USE_API_KEY" \
--header 'Content-Type: application/json' \
--data '{
"name": "Two-Person Tent",
"scopes": [
"string"
],
"rate_limit_per_minute": 60
}'
{
"id": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
"name": "Two-Person Tent",
"key": "string",
"key_prefix": "string",
"scopes": [
"string"
],
"rate_limit_per_minute": 8,
"created_at": "2026-08-31T14:22:05Z"
}
Create Api Key V1
Create a new API key for the calling tenant. Requires the admin scope on the calling key — non-admin keys can only read and use keys, not mint new ones…
POST
/
api
/
v1
/
keys
curl --silent --show-error --fail-with-body --request POST \
--url 'https://api.computer.stateset.app/api/v1/keys' \
--header "X-API-Key: $STATESET_COMPUTER_USE_API_KEY" \
--header 'Content-Type: application/json' \
--data '{
"name": "Two-Person Tent",
"scopes": [
"string"
],
"rate_limit_per_minute": 60
}'
{
"id": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
"name": "Two-Person Tent",
"key": "string",
"key_prefix": "string",
"scopes": [
"string"
],
"rate_limit_per_minute": 8,
"created_at": "2026-08-31T14:22:05Z"
}
Confirm your deployment before running this request. This page describes an API contract;
a published reference does not establish hosted availability. Check the dated
host report and obtain your deployment URL and credentials.
Replace the example host if your provisioned service uses a different URL.
admin scope on the calling key — non-admin keys can
only read and use keys, not mint new ones. The plaintext is returned
once in this response and never again; lose it and the only path
forward is to delete and re-create.
Request body
CreateAPIKeyRequest
string
required
Human-readable label, e.g. ‘CI bot’ or ‘Slack integration’. Minimum length:
1. Maximum length: 128.string[]
Allowed scopes. Empty list = full-access (back-compat). Otherwise must be a subset of: trigger:write, jobs:read, jobs:write, admin.
integer
Per-key request budget. Range 1..10000. Default:
60. Minimum: 1. Maximum: 10000.Response
CreateAPIKeyResponse
string
required
string
required
string
required
Plaintext API key — store it now. The platform only retains the SHA-256 hash; this is the one and only time the secret is exposed.
string
required
string[]
required
integer
required
string
required
Status codes
| Code | Meaning |
|---|---|
201 | Successful Response |
422 | Validation Error |
Using this contract
Read the source OpenAPI document for declared schemas and alternatives. This page also includes documented corrections from the spec overlays. Example IDs and values are illustrative; replace them with records from your workspace.curl --silent --show-error --fail-with-body --request POST \
--url 'https://api.computer.stateset.app/api/v1/keys' \
--header "X-API-Key: $STATESET_COMPUTER_USE_API_KEY" \
--header 'Content-Type: application/json' \
--data '{
"name": "Two-Person Tent",
"scopes": [
"string"
],
"rate_limit_per_minute": 60
}'
{
"id": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
"name": "Two-Person Tent",
"key": "string",
"key_prefix": "string",
"scopes": [
"string"
],
"rate_limit_per_minute": 8,
"created_at": "2026-08-31T14:22:05Z"
}
Last modified on September 21, 2026