Mint a new credential

post

https://staging.ankatech.co/api/v3/admin/tenants/{tenantId}/actors/{actorId}/credentials

Generates a server-side 256-bit secret, stores a PBKDF2-HMAC-SHA256 hash, and returns the plaintext exactly once. Subsequent reads never include the plaintext — if lost, rotate. The request body is optional; when omitted, defaults apply (validFrom = now(), validUntil = no expiry).

Recent Requests

Time	Status	User Agent
Retrieving recent requests…

Loading…

Path Params

tenantId

uuid

required

actorId

uuid

required

Body Params

Optional credential shape and validity window. Every field may be omitted; the defaults are kind = CLIENT_SECRET, validFrom = now() and validUntil = null.

kind

string

enum

Which proof mechanism this credential establishes. Omitted means CLIENT_SECRET, which is what a caller with no body gets. FEDERATED_JWT is REFUSED here (422): ANKASecure holds no material for a federated identity, so it is declared as an issuer binding for the actor rather than minted as a credential.

Allowed:

publicJwk

string

The actor's PUBLIC JWK, required when kind = PRIVATE_KEY_JWT and refused otherwise. Exactly one key, public members only; the admitted members per kty are an allow-list, so anything outside it is refused rather than ignored.

validFrom

date-time

Credential becomes valid at this instant (ISO-8601). Defaults to server now() when omitted.

validUntil

date-time

Credential becomes invalid at this instant. Null = no expiry.

Headers

string

enum

Defaults to application/json

Generated from available response content types

Allowed:

content-type

string

enum

Defaults to application/json

Generated from available request content types

Allowed:

Responses

Language

Credentials

Bearer

JWT

URL

Loading…

Response

Click Try It! to start a request and see the response here! Or choose an example:

application/json

application/problem+json

201Credential minted — plaintext in body

400Invalid validity window (validFrom >= validUntil, or validUntil in the past)

404Actor not found in tenant

503This deployment has no public edge base URL configured (PUBLIC_EDGE_BASE_URL), so the audience this workload must name in its assertions cannot be derived. The question is asked before the first write, so no credential was stored and no prior credential was revoked.