Create Admin Key
Mint an admin key. The plaintext is returned exactly once.
D4 rule 1: the caller may grant only permissions they already hold, at a
scope they already hold — checked against check_org_permissions’s
resolved OrgAccess, never against the token’s own claims.
Authorizations
Enter your MeshAPI key (rsk_...) or, for the admin-keys endpoints, a dashboard session token — sent as Authorization: Bearer <token>.
Headers
Dated version of the API contract to pin this request to. Omit it and the request is served under 2026-08 — the oldest supported version, so an existing integration is never moved by a release. A malformed or unsupported value is rejected with 400 invalid_api_version rather than falling back silently. The version actually served is echoed as X-Mesh-Version on every response, including errors.
2026-08 Body
1alerts:read, alerts:write, keys:read, keys:write, limits:read, limits:write, org:read self, team, org Must include a UTC offset and be no more than 90 days from now. No default — every admin key expires (D5).
Response
Successful Response
What a member of an organisation may do.
The enum VALUES are the wire format — they appear in 403 messages and in the dashboard's gating. Renaming one is a breaking change for the dashboard; adding one is not.
keys:read, keys:write, members:read, members:write, billing:read, billing:pay, usage:read, provider_keys:read, provider_keys:write, limits:read, limits:write, alerts:read, alerts:write, org:read, org:write, teams:read, teams:write self, team, org