Skip to content
KataraKatara documentation

Create an environment-bound API key with explicit product permissions

POST
/katara/v1/account/keys
curl --request POST \
  --url https://api.katara.com/katara/v1/account/keys \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'Idempotency-Key: example' \
  --header 'X-Katara-CSRF: 1' \
  --data '"example"'

Authorizations

Section titled “Authorizations”

Parameters

Section titled “Parameters”

Header Parameters

Section titled “Header Parameters”
Idempotency-Key
required
string
/^[A-Za-z0-9._:-]{8,128}$/
X-Katara-CSRF
Allowed value: 1

Browser cookie mutations require value 1 and an allowed Origin. Session bearer clients may omit this header.

X-Katara-Account-ID
string format: uuid
/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/

Required for cookie-authenticated changes. Use the UUID of the account that loaded the application. A different current cookie account returns account_changed before the handler runs. Session bearer and API key clients do not require this header.

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json

Keys with Cortex permission and no direct billing mode require managed-run creation permission. Their inference uses separately consented run budgets. Direct inference requires a configured billing mode, a personal identity and no resource restriction. A Live key pays with credits, the wallet allowance or a prepaid balance. A Test key pays with test USDC through the allowance or a prepaid balance, and only where the deployment runs a Test network; otherwise, or when it asks for credits, the request is refused with param mode. Community false keeps a key’s direct Cortex requests on Katara’s own models; it is on when omitted, and a marketplace-only key cannot turn it off.

object
org_id
required
string format: uuid
/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/
Allowed value: 00000000-0000-0000-0000-000000000000
environment_id
required
string format: uuid
/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/
Allowed value: 00000000-0000-0000-0000-000000000000
audience
required
Allowed value: katara:platform
scopes
required
Array
>= 1 items <= 50 items unique items
Allowed values: billing:read billing:write cortex:inference keys:write locus:actions:execute locus:actions:read locus:audit:read locus:grants:delegate locus:grants:read locus:grants:write locus:policies:read locus:policies:write locus:tools:read locus:tools:write notifications:admin org:environments:promote org:environments:reset org:federation:write org:members:write org:ownership:transfer org:read org:service_accounts:write synapse:agents:read synapse:agents:write synapse:evaluations:read synapse:evaluations:write synapse:memory:read synapse:memory:write synapse:memory:index synapse:promotions:write synapse:reviews:write synapse:runs:cancel synapse:runs:create synapse:runs:read synapse:runs:export synapse:schedules:write synapse:event_sources:write
resources
Array<string>
<= 1000 items unique items
service_account_id
string format: uuid
/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/
Allowed value: 00000000-0000-0000-0000-000000000000
expires_at
required
string format: date-time
name
required
string
>= 1 characters <= 64 characters /.*\S.*/
mode
Allowed values: "" credits allowance prepaid
marketplace_only
boolean
community
boolean

Responses

Section titled “Responses”

201

Section titled “201”

Successful request

Media typeapplication/json
object
api_key
required
object
org_id
required
string format: uuid
/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/
Allowed value: 00000000-0000-0000-0000-000000000000
environment_id
required
string format: uuid
/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/
Allowed value: 00000000-0000-0000-0000-000000000000
audience
required
Allowed value: katara:platform
scopes
required
Array
>= 1 items <= 50 items unique items
Allowed values: billing:read billing:write cortex:inference keys:write locus:actions:execute locus:actions:read locus:audit:read locus:grants:delegate locus:grants:read locus:grants:write locus:policies:read locus:policies:write locus:tools:read locus:tools:write notifications:admin org:environments:promote org:environments:reset org:federation:write org:members:write org:ownership:transfer org:read org:service_accounts:write synapse:agents:read synapse:agents:write synapse:evaluations:read synapse:evaluations:write synapse:memory:read synapse:memory:write synapse:memory:index synapse:promotions:write synapse:reviews:write synapse:runs:cancel synapse:runs:create synapse:runs:read synapse:runs:export synapse:schedules:write synapse:event_sources:write
resources
Array<string>
<= 1000 items unique items
service_account_id
string format: uuid
/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/
Allowed value: 00000000-0000-0000-0000-000000000000
expires_at
required
string format: date-time
id
required
string format: uuid
/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/
Allowed value: 00000000-0000-0000-0000-000000000000
name
required
string
>= 1 characters <= 64 characters /.*\S.*/
prefix
required
string
>= 1 characters <= 32 characters
buyer
required
string
mode
required
Allowed values: "" credits allowance prepaid
marketplace_only
required
boolean
community
required
boolean
created_at
required
string format: date-time
last_used_at
string format: date-time
revoked_at
string format: date-time
operation
required
object
operation_id
required
string format: uuid
/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/
Allowed value: 00000000-0000-0000-0000-000000000000
resource_id
required
string format: uuid
/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/
Allowed value: 00000000-0000-0000-0000-000000000000
completed
required
boolean
key
string
>= 1 characters <= 256 characters
Example
{
  "api_key": {
    "audience": "katara:platform",
    "scopes": [
      "billing:read"
    ],
    "mode": ""
  }
}

409

Section titled “409”

Account_changed: reload and review with the signed-in account.

default

Section titled “default”

Request error

Media typeapplication/json
object
error
required
object
message
required
string
>= 1 characters <= 500 characters
type
required
string
>= 1 characters <= 100 characters
code
required

Stable; branch on it. Any operation can answer invalid_request, with param naming the refused field when there is one; human_session_required, when an API key, service account or workload calls an operation only a signed-in person may perform; reauthentication_required, when a person’s sign-in is too old for the operation; permission_denied; route_not_found and method_not_allowed, when no operation matches the path or method; and feature_unavailable, when the operation’s service is not enabled on this deployment.

string
>= 1 characters <= 100 characters
param
required

The request field a refusal is about, such as the agent_id or run_id query parameter; null when the refusal is not about one field.

string | null
request_id
required
string
>= 1 characters <= 100 characters
upstream_status
required
integer | null
action
Allowed values: sign_in reauthenticate request_access review fund retry reconcile refresh support
operation_id
string format: uuid
/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/
Allowed value: 00000000-0000-0000-0000-000000000000
snapshot_ref
string format: uuid
/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/
Allowed value: 00000000-0000-0000-0000-000000000000
Example
{
  "error": {
    "action": "sign_in"
  }
}