创建 API 密钥

OpenAPI 契约

方法

POST

路径

/api/v1/api-keys

认证

jwtBearer (bearer)

响应状态

201 400 401 403 404 409 429 500

请求与响应 Schema

JSON

{
  "requestBody": {
    "application/json": {
      "$ref": "#/components/schemas/CreateApiKeyRequest"
    }
  },
  "responses": {
    "201": {
      "description": "API key created",
      "content": {
        "application/json": {
          "$ref": "#/components/schemas/CreateApiKeyResponse"
        }
      }
    },
    "400": {
      "description": "Invalid request",
      "content": {
        "application/json": {
          "$ref": "#/components/schemas/RequestError"
        }
      }
    },
    "401": {
      "description": "Authentication required or invalid",
      "content": {
        "application/json": {
          "$ref": "#/components/schemas/SecurityError"
        }
      }
    },
    "403": {
      "description": "Authenticated but not permitted",
      "content": {
        "application/json": {
          "$ref": "#/components/schemas/SecurityError"
        }
      }
    },
    "404": {
      "description": "Requested API key was not found",
      "content": {
        "application/json": {
          "$ref": "#/components/schemas/ApiError"
        }
      }
    },
    "409": {
      "description": "Active API-key limit reached",
      "content": {
        "application/json": {
          "$ref": "#/components/schemas/ApiError"
        }
      }
    },
    "429": {
      "description": "Rate limit exceeded",
      "content": {
        "application/json": {
          "$ref": "#/components/schemas/SecurityError"
        }
      }
    },
    "500": {
      "description": "Unexpected server error",
      "content": {
        "application/json": {
          "$ref": "#/components/schemas/ApiError"
        }
      }
    }
  }
}

POST /api/v1/api-keys 仅限 JWT。提交 name（非空、最多 100 个字符）、非空 scopes 集合和可选的未来 expiresAt。还可设置 usageLimitNcu（每个账户额度刷新周期内的 NCU 上限）以及 allowedCidrs（最多 50 个严格的 IPv4/IPv6 字面量或 CIDR 网络）；空 CIDR 集合表示不限制来源。

支持的范围为 build:read、build:write、artifact:read、project:read、project:write、processor:read、processor:write 和 analytics:read。各范围彼此独立：写权限不隐含读权限。成功响应包含 API 密钥元数据和一次性的 secret。

将返回的 nfy_ 密钥直接复制到安全的 CI 密钥存储；列表接口永不再次返回它。元数据只公开非秘密的 nfy_ 前缀。响应标记为 Cache-Control: no-store。密钥不能创建、列出、更新或撤销密钥。无效范围、过期时间、用量限制或 IP 条目会被拒绝；达到活跃密钥上限会产生冲突。

http

POST /api/v1/api-keys
Authorization: Bearer <access token>
Content-Type: application/json