APIKeyCreateV5

Request body for creating a v5 scoped-permission API key. permissions must be non-empty and may only contain permissions the caller itself holds (privilege-escalation guard). legacy_all cannot be requested.

  • name
    Type: string · Name
    required
  • permissions
    Type: array string[] · Permissions 1… unique!enum
    required
    values
    • payments:tap-ios
    • payments:tap-android
    • payments:read
    • payments:refund
    • payments:tipadjust
    • Type: string · Permissionenum

      A scoped permission a v5 API key can hold. Format is resource:action or resource:action:subtype. all grants every concrete permission; legacy_all is a grandfathered bucket set only on migrated pre-v5 keys and cannot be granted to new keys. The apikeys:*:sub variants govern keys on descendant (sub-) accounts. webhooks:* can only be granted by Koard PSP accounts.

      values
      • payments:tap-ios
      • payments:tap-android
      • payments:read
      • payments:refund
      • payments:tipadjust
  • account_id
    Type: string · Account Idnullable

    Ignored on /v5/apikeys — the key is always issued on the caller's own account.

  • always_retrievable
    Type: boolean · Always Retrievable

    Visibility of the plaintext key. false (default) means the key is shown exactly once, on this create response. true retains the plaintext and returns it on every subsequent read. Only valid together with a caller-supplied key — requesting it without one is a validation error, because Koard never retains the plaintext of a key it generated.

  • expires_at
    Type: string · Expires AtFormat: date-timenullable

    Optional expiry. Defaults to a long-lived expiry when omitted.

  • key
    Type: string · Keynullable

    Optional bring-your-own-key. When provided, this exact value becomes the account's API key (used verbatim in the x-koard-apikey header) instead of one Koard generates. Must match the v5 key format. Only a salted hash is stored; the plaintext is echoed back on this response.