Request a narrower API key
Asks for a new API key in the same organization, for handing to another tool or sub-agent. Nothing is minted by this call. An org owner or admin is notified and approves or denies the request in the dashboard, where they may narrow its scopes or shorten its lifetime but never widen either.
scopes must be a subset of the calling credential's own scopes and may
not include api.api_keys.request, so a minted key cannot request in
turn. The key will be in the caller's environment (a test credential
gets a test key). expires_in_days defaults to 30 and is at most 90.
The response carries a one-time claim_token. Keep it: it is shown
once, and the key can only be claimed by this same credential
presenting it. A pending request lapses after 24 hours. A caller may
hold at most 3 pending requests (5 per organization), and may make 10
requests an hour; beyond either the answer is 429.
An OAuth token must be a user-authorized connection: a
client_credentials token has no grant to tie the request to and is
refused with 422.
Request body
Content type: application/json
name string required A name for the key, shown in the dashboard.
scopes array<string> required The scopes asked for. A subset of the caller's own; never api.api_keys.request.
expires_in_days integer optional The key's lifetime once claimed. Defaults to 30.
Constraints: 1–90
reason string optional Why the key is needed, shown to the approving admin.
Constraints: length 0–500
Responses
Errors follow the RFC 7807 problem format — see the error reference.
id string<uuid> required status string enum required One of: pending
name string required environment string enum required One of: live, test
scopes array<string> required expires_in_days integer required reason string required request_expires_at string<date-time> required When the request lapses if nobody decides it (24 hours).
created_at string<date-time> required claim_token string required One-time token (kr_…) needed to claim the key once approved. Shown only here; it is stored only as a hash.
code is conflict.
application/problem+json validation_failed Problem. When the refusal is about a
reference — a segment key, template slug, topic or attribute name the
organization does not have — it additionally carries validation_code,
field, line/column, missing, candidates and next_step, so a
client can correct the call without a second round of guessing. See
ValidationProblem.
application/problem+json code is internal_error. The
request_id field can be quoted to SendOps support to investigate.
application/problem+json