> ## Documentation Index > Fetch the complete documentation index at: https://docs.attaxr.com/llms.txt > Use this file to discover all available pages before exploring further. # Create a new API key for a user > Create a new API key for a user ## OpenAPI ````yaml /api/openapi.json post /api/auth/api-key/create openapi: 3.1.0 info: title: Aquila API version: 1.0.0 description: >- Event-driven reconnaissance platform API. All /api/* routes except /api/public/* require an authenticated session (cookie), an X-Api-Key header, or a bearer token. Auth endpoints under /api/auth/* are generated by Better Auth. servers: - url: https://aquila.attaxr.com - url: http://localhost security: [] tags: - name: AI - name: Agents - name: Bulk Delete - name: Chat - name: Constraints - name: Dashboard - name: Events - name: JS - name: JS Analysis - name: JS Monitoring - name: Leads - name: MCP Key - name: Models - name: Notification Channels - name: Notification Event Preferences - name: Notifications - name: OOB - name: Provider Keys - name: Public Shares - name: Reinforcements - name: Reports - name: Scans - name: Schedules - name: Shares - name: Tools - name: User Profiles - name: V1 - name: Vulnerabilities - name: Workflows paths: /api/auth/api-key/create: post: tags: - Auth summary: Create a new API key for a user description: Create a new API key for a user parameters: [] requestBody: required: true content: application/json: schema: type: object properties: configId: type: string description: >- The configuration ID to use for the API key. If not provided, the default configuration will be used. name: type: string description: Name of the Api Key expiresIn: type: - number - 'null' description: Expiration time of the Api Key in seconds prefix: type: string description: Prefix of the Api Key remaining: type: - number - 'null' description: Remaining number of requests. Server side only metadata: {} refillAmount: type: number description: >- Amount to refill the remaining count of the Api Key. server-only. Eg: 100 refillInterval: type: number description: >- Interval to refill the Api Key in milliseconds. server-only. Eg: 1000 rateLimitTimeWindow: type: number description: >- The duration in milliseconds where each request is counted. Once the `maxRequests` is reached, the request will be rejected until the `timeWindow` has passed, at which point the `timeWindow` will be reset. server-only. Eg: 1000 rateLimitMax: type: number description: >- Maximum amount of requests allowed within a window. Once the `maxRequests` is reached, the request will be rejected until the `timeWindow` has passed, at which point the `timeWindow` will be reset. server-only. Eg: 100 rateLimitEnabled: type: boolean description: >- Whether the key has rate limiting enabled. server-only. Eg: true permissions: type: object propertyNames: type: string additionalProperties: type: array items: type: string description: Permissions of the Api Key. userId: type: string description: >- User Id of the user that the Api Key belongs to. server-only. Eg: "user-id" organizationId: type: string description: >- Organization Id of the organization that the Api Key belongs to. Eg: 'org-id' responses: '200': description: API key created successfully content: application/json: schema: type: object properties: id: type: string description: Unique identifier of the API key createdAt: type: string format: date-time description: Creation timestamp updatedAt: type: string format: date-time description: Last update timestamp name: type: string nullable: true description: Name of the API key prefix: type: string nullable: true description: Prefix of the API key start: type: string nullable: true description: Starting characters of the key (if configured) key: type: string description: The full API key (only returned on creation) enabled: type: boolean description: Whether the key is enabled expiresAt: type: string format: date-time nullable: true description: Expiration timestamp referenceId: type: string description: ID of the reference owning the key lastRefillAt: type: string format: date-time nullable: true description: Last refill timestamp lastRequest: type: string format: date-time nullable: true description: Last request timestamp metadata: type: object nullable: true additionalProperties: true description: Metadata associated with the key rateLimitMax: type: number nullable: true description: Maximum requests in time window rateLimitTimeWindow: type: number nullable: true description: Rate limit time window in milliseconds remaining: type: number nullable: true description: Remaining requests refillAmount: type: number nullable: true description: Amount to refill refillInterval: type: number nullable: true description: Refill interval in milliseconds rateLimitEnabled: type: boolean description: Whether rate limiting is enabled requestCount: type: number description: Current request count in window permissions: type: object nullable: true additionalProperties: type: array items: type: string description: Permissions associated with the key required: - id - createdAt - updatedAt - key - enabled - referenceId - rateLimitEnabled - requestCount '400': content: application/json: schema: type: object properties: message: type: string required: - message description: >- Bad Request. Usually due to missing parameters, or invalid parameters. '401': content: application/json: schema: type: object properties: message: type: string required: - message description: Unauthorized. Due to missing or invalid authentication. '403': content: application/json: schema: type: object properties: message: type: string description: >- Forbidden. You do not have permission to access this resource or to perform this action. '404': content: application/json: schema: type: object properties: message: type: string description: Not Found. The requested resource was not found. '429': content: application/json: schema: type: object properties: message: type: string description: >- Too Many Requests. You have exceeded the rate limit. Try again later. '500': content: application/json: schema: type: object properties: message: type: string description: >- Internal Server Error. This is a problem with the server that you cannot fix. security: - bearerAuth: [] components: securitySchemes: bearerAuth: type: http scheme: bearer description: Personal API key sent as a bearer token. ````