> ## Documentation Index
> Fetch the complete documentation index at: https://developers.meshapi.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Create Admin Key

> Mint an admin key. The plaintext is returned exactly once.

D4 rule 1: the caller may grant only permissions they already hold, at a
scope they already hold — checked against `check_org_permissions`'s
resolved `OrgAccess`, never against the token's own claims.



## OpenAPI

````yaml /api/openapi.json post /v1/admin-keys
openapi: 3.1.0
info:
  title: MeshAPI
  description: One key, all AI models.
  version: 0.1.0
servers:
  - url: https://api.meshapi.ai
security:
  - BearerAuth: []
paths:
  /v1/admin-keys:
    post:
      tags:
        - Admin Keys
      summary: Create Admin Key
      description: |-
        Mint an admin key. The plaintext is returned exactly once.

        D4 rule 1: the caller may grant only permissions they already hold, at a
        scope they already hold — checked against `check_org_permissions`'s
        resolved `OrgAccess`, never against the token's own claims.
      operationId: create_admin_key
      parameters:
        - in: header
          name: X-Mesh-Version
          required: false
          schema:
            type: string
            enum:
              - 2026-08
            default: 2026-08
          example: 2026-08
          description: >-
            Dated version of the API contract to pin this request to. Omit it
            and the request is served under `2026-08` — the oldest supported
            version, so an existing integration is never moved by a release. A
            malformed or unsupported value is rejected with `400
            invalid_api_version` rather than falling back silently. The version
            actually served is echoed as `X-Mesh-Version` on every response,
            including errors.
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateAdminKeyRequest'
        required: true
      responses:
        '201':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AdminKeyCreateResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
        - BearerAuth: []
components:
  schemas:
    CreateAdminKeyRequest:
      properties:
        name:
          type: string
          title: Name
        permissions:
          items:
            type: string
            enum:
              - alerts:read
              - alerts:write
              - keys:read
              - keys:write
              - limits:read
              - limits:write
              - org:read
          type: array
          minItems: 1
          title: Permissions
        scope:
          type: string
          enum:
            - self
            - team
            - org
        team_id:
          anyOf:
            - type: string
            - type: 'null'
          title: Team Id
        expires_at:
          type: string
          format: date-time
          title: Expires At
          description: >-
            Must include a UTC offset and be no more than 90 days from now. No
            default — every admin key expires (D5).
      type: object
      required:
        - name
        - permissions
        - scope
        - expires_at
      title: CreateAdminKeyRequest
    AdminKeyCreateResponse:
      properties:
        id:
          type: string
          title: Id
        name:
          type: string
          title: Name
        masked_key:
          type: string
          title: Masked Key
        permissions:
          items:
            $ref: '#/components/schemas/OrgPermission'
          type: array
          title: Permissions
        scope:
          type: string
          enum:
            - self
            - team
            - org
        team_id:
          anyOf:
            - type: string
            - type: 'null'
          title: Team Id
        org_id:
          type: string
          title: Org Id
        expires_at:
          type: string
          format: date-time
          title: Expires At
        revoked_at:
          anyOf:
            - type: string
              format: date-time
            - type: 'null'
          title: Revoked At
        revoked_by:
          anyOf:
            - type: string
            - type: 'null'
          title: Revoked By
        revoked_reason:
          anyOf:
            - type: string
            - type: 'null'
          title: Revoked Reason
        rotated_from_id:
          anyOf:
            - type: string
            - type: 'null'
          title: Rotated From Id
        created_by:
          type: string
          title: Created By
        last_used_at:
          anyOf:
            - type: string
              format: date-time
            - type: 'null'
          title: Last Used At
        created_at:
          type: string
          format: date-time
          title: Created At
        key:
          type: string
          title: Key
      type: object
      required:
        - id
        - name
        - masked_key
        - permissions
        - scope
        - team_id
        - org_id
        - expires_at
        - revoked_at
        - revoked_by
        - revoked_reason
        - rotated_from_id
        - created_by
        - last_used_at
        - created_at
        - key
      title: AdminKeyCreateResponse
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          type: array
          title: Detail
      type: object
      title: HTTPValidationError
    OrgPermission:
      type: string
      enum:
        - keys:read
        - keys:write
        - members:read
        - members:write
        - billing:read
        - billing:pay
        - usage:read
        - provider_keys:read
        - provider_keys:write
        - limits:read
        - limits:write
        - alerts:read
        - alerts:write
        - org:read
        - org:write
        - teams:read
        - teams:write
      title: OrgPermission
      description: >-
        What a member of an organisation may do.


        The enum VALUES are the wire format — they appear in 403 messages and in
        the

        dashboard's gating. Renaming one is a breaking change for the dashboard;

        adding one is not.
    ValidationError:
      properties:
        loc:
          items:
            anyOf:
              - type: string
              - type: integer
          type: array
          title: Location
        msg:
          type: string
          title: Message
        type:
          type: string
          title: Error Type
        input:
          title: Input
        ctx:
          type: object
          title: Context
      type: object
      required:
        - loc
        - msg
        - type
      title: ValidationError
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer
      description: >-
        Enter your MeshAPI key (`rsk_...`) or, for the admin-keys endpoints, a
        dashboard session token — sent as `Authorization: Bearer <token>`.

````