Create Api Key

API Key management

POST /textql.rpc.public.rbac.RBACService/CreateApiKey

TypeScript (SDK)

TypeScript

import { Textql } from "@textql/sdk";

const textql = new Textql({
  apiKey: process.env["TEXTQL_API_KEY"] ?? "",
});

async function run() {
  const result = await textql.rbac.createApiKey({
    body: {},
  });

  console.log(result);
}

run();

200

{
  "apiKey": {
    "id": "<string>",
    "memberId": "<string>",
    "clientId": "<string>",
    "createdAt": "2023-01-15T01:30:15.01Z",
    "apiKeyShort": "<string>",
    "assumedRoleNames": [
      "<string>"
    ],
    "assumedRoles": [
      "<string>"
    ],
    "name": "<string>",
    "expiresAt": "2023-01-15T01:30:15.01Z",
    "revokedAt": "2023-01-15T01:30:15.01Z",
    "status": "API_KEY_STATUS_UNSPECIFIED",
    "ownerDisplayName": "<string>",
    "ownerEmail": "<string>",
    "suppressSuperadmin": true
  },
  "apiKeySecret": "<string>",
  "apiKeyHash": "<string>"
}

Authorizations

tql_api_key · string · header · required

Headers

Connect-Protocol-Version · enum<string> · default: 1 · required

Define the version of the Connect protocol

Available options: 1

Allowed value: "1"

Connect-Timeout-Ms · number

Define the timeout, in ms

Body

application/json

targetMemberEmail · string | null

Email within the caller's organization; case-insensitive, with outer whitespace ignored. Use instead of target_member_id; if both are supplied they must identify the same member.

assumedRoleNames · string[]

Exact, case-sensitive role names in the caller's organization. Merged with legacy assumed_roles IDs and deduplicated. The existing member-role and calling API-key scope restrictions apply to both forms.

expirySeconds · integer | null

assumedRoles · string[]

Role IDs (UUIDs) to scope the new API key to. The service validates that each ID exists in the caller's org. Non-admin callers may only specify roles they already hold; assumed-role API key callers may only specify a subset of their current assumed roles. Legacy role IDs. Prefer assumed_role_names.

inheritAllRoles · boolean | null

When true, the API key inherits all of the creating member's roles (no assumed-role scoping). Callers must set this explicitly when both role lists are empty; otherwise the request is rejected to prevent accidentally creating over-privileged keys.

name · string | null

Optional display name for the API key.

targetMemberId · string | null

Optional owner override for the new API key. If unset, the API key is created for the calling member. If set, the API key is created for this member ID (target principal): service-account targets require the caller to hold organization:write; human targets require api_access_key:delegate, and the key is bounded by the target member's roles with superadmin elevation always suppressed.

clientId · string | null

Optional client metadata stored on the API key as client_id. Prefer a JSON object string when using structured client attributes.

suppressSuperadmin · boolean

When true, requests authenticated with this key skip the @textql.com-email superadmin elevation branch. Only meaningful when paired with assumed_roles so a textql admin can preview a role's experience without superadmin permissions bleeding through.

fullMemberAccess · boolean

Response

200

application/json

Success

apiKey · api_key · object

Show child attributes

apiKeySecret · string

apiKeyHash · string · deprecated

Deprecated compatibility alias for api_key_secret. This field contains the same one-time bearer credential; it is not the hash stored at rest.