# Request a narrower API key

`POST /v1/api-key-requests`

- Authentication: required (Bearer token)
- Required scope: `api.api_keys.request`

Asks for a new API key in the same organization, for handing to
another tool or sub-agent. **Nothing is minted by this call.** An org
owner or admin is notified and approves or denies the request in the
dashboard, where they may narrow its scopes or shorten its lifetime but
never widen either.

`scopes` must be a subset of the calling credential's own scopes and may
not include `api.api_keys.request`, so a minted key cannot request in
turn. The key will be in the caller's environment (a test credential
gets a test key). `expires_in_days` defaults to 30 and is at most 90.

The response carries a one-time `claim_token`. Keep it: it is shown
once, and the key can only be claimed by this same credential
presenting it. A pending request lapses after 24 hours. A caller may
hold at most 3 pending requests (5 per organization), and may make 10
requests an hour; beyond either the answer is `429`.

An OAuth token must be a user-authorized connection: a
`client_credentials` token has no grant to tie the request to and is
refused with `422`.

## Request body

Content type: `application/json`

```json
{
  "name": "string",
  "scopes": [
    "string"
  ],
  "expires_in_days": 0,
  "reason": "string"
}
```

## Example request

```bash
curl -X POST 'https://api.sendops.dev/v1/api-key-requests' \
  -H "Authorization: Bearer $SENDOPS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name":"string","scopes":["string"],"expires_in_days":0,"reason":"string"}'
```

## Responses

### 201 — The pending request and its one-time claim token

Content type: `application/json`

```json
{
  "id": "00000000-0000-0000-0000-000000000000",
  "status": "pending",
  "name": "string",
  "environment": "live",
  "scopes": [
    "string"
  ],
  "expires_in_days": 0,
  "reason": "string",
  "request_expires_at": "2026-05-17T20:00:00Z",
  "created_at": "2026-05-17T20:00:00Z",
  "claim_token": "string"
}
```

### 401 — Missing, malformed, or unknown API key

Content type: `application/problem+json`

```json
{
  "type": "https://example.com",
  "title": "string",
  "status": 0,
  "detail": "string",
  "code": "invalid_key",
  "request_id": "string",
  "retry_after": 0,
  "retention_days": 0,
  "scope": "string",
  "resource": "string",
  "errors": [
    {
      "field": "string",
      "reason": "string"
    }
  ],
  "attribute_id": "00000000-0000-0000-0000-000000000000",
  "content_hash": "string",
  "differs": [
    "string"
  ]
}
```

### 403 — Key lacks the required scope or plan limit violated

Content type: `application/problem+json`

```json
{
  "type": "https://example.com",
  "title": "string",
  "status": 0,
  "detail": "string",
  "code": "invalid_key",
  "request_id": "string",
  "retry_after": 0,
  "retention_days": 0,
  "scope": "string",
  "resource": "string",
  "errors": [
    {
      "field": "string",
      "reason": "string"
    }
  ],
  "attribute_id": "00000000-0000-0000-0000-000000000000",
  "content_hash": "string",
  "differs": [
    "string"
  ]
}
```

### 409 — The mutation is rejected by a state rule rather than a bad request. The
`code` is `conflict`.

Content type: `application/problem+json`

```json
{
  "type": "https://example.com",
  "title": "string",
  "status": 0,
  "detail": "string",
  "code": "invalid_key",
  "request_id": "string",
  "retry_after": 0,
  "retention_days": 0,
  "scope": "string",
  "resource": "string",
  "errors": [
    {
      "field": "string",
      "reason": "string"
    }
  ],
  "attribute_id": "00000000-0000-0000-0000-000000000000",
  "content_hash": "string",
  "differs": [
    "string"
  ]
}
```

### 422 — A query parameter, path value or body field failed validation.

The body is a `validation_failed` Problem. When the refusal is about a
reference — a segment key, template slug, topic or attribute name the
organization does not have — it additionally carries `validation_code`,
`field`, `line`/`column`, `missing`, `candidates` and `next_step`, so a
client can correct the call without a second round of guessing. See
`ValidationProblem`.

Content type: `application/problem+json`

```json
{
  "type": "https://example.com",
  "title": "string",
  "status": 0,
  "detail": "string",
  "code": "invalid_key",
  "request_id": "string",
  "retry_after": 0,
  "retention_days": 0,
  "scope": "string",
  "resource": "string",
  "errors": [
    {
      "field": "string",
      "reason": "string"
    }
  ],
  "attribute_id": "00000000-0000-0000-0000-000000000000",
  "content_hash": "string",
  "differs": [
    "string"
  ],
  "validation_code": "invalid_syntax",
  "field": "string",
  "line": 0,
  "column": 0,
  "missing": [
    {
      "kind": "segment",
      "key": "string"
    }
  ],
  "candidates": {},
  "next_step": "string"
}
```

### 429 — Per-org rate limit exceeded

Content type: `application/problem+json`

```json
{
  "type": "https://example.com",
  "title": "string",
  "status": 0,
  "detail": "string",
  "code": "invalid_key",
  "request_id": "string",
  "retry_after": 0,
  "retention_days": 0,
  "scope": "string",
  "resource": "string",
  "errors": [
    {
      "field": "string",
      "reason": "string"
    }
  ],
  "attribute_id": "00000000-0000-0000-0000-000000000000",
  "content_hash": "string",
  "differs": [
    "string"
  ]
}
```

### 500 — Unexpected server-side failure. The `code` is `internal_error`. The
`request_id` field can be quoted to SendOps support to investigate.

Content type: `application/problem+json`

```json
{
  "type": "https://example.com",
  "title": "string",
  "status": 0,
  "detail": "string",
  "code": "invalid_key",
  "request_id": "string",
  "retry_after": 0,
  "retention_days": 0,
  "scope": "string",
  "resource": "string",
  "errors": [
    {
      "field": "string",
      "reason": "string"
    }
  ],
  "attribute_id": "00000000-0000-0000-0000-000000000000",
  "content_hash": "string",
  "differs": [
    "string"
  ]
}
```