API Reference
  1. Anka Secure Admin API
  2. Tenant Applications

Create a cryptographic key

post
https://staging.ankatech.co/api/v3/admin/tenants//keys

Creates a cryptographic key in the tenant's keystore.

Workflow:

  1. Validates the caller's tenant boundary
  2. Calls Core-API to create the cryptographic key (S2S)
  3. Returns the created key's identity, algorithm and lifecycle status

Authorization is a SEPARATE concern and is not granted here: issue and read
access to the key through the Capability Grant endpoints, or compose an
Internal Crypto Use Case over the returned kid. The endpoint grants nothing
and names no application - the grantTo field that once carried that half of
the operation was removed in the PRD §40 greenfield cutover.

Available in every tenant type. A SIMPLE tenant creates keys through exactly
this endpoint (PRD §168 FR-168.10): its Internal Crypto Use Cases are an
authorization overlay over keys that already exist, so key creation is the one
key-plane operation a SIMPLE tenant must be able to perform for itself.

Error handling:

  • If key creation fails, the entire operation is aborted (404, 409, 504 returned)
Recent Requests
Log in to see full request history
TimeStatusUser Agent
Retrieving recent requests…
LoadingLoading…
Path Params
uuid
required
Body Params

Request for key creation. Permission grants are issued separately.

string
required
length between 0 and 255

Human-readable key identifier (kid)

string
required
length between 0 and 64

Key type (kty). Must be a published key type; the set is closed and membership is exact in case. A composite key carries the coarse token COMPOSITE, never a construction name.

string
required
length ≥ 1

Cryptographic algorithm

keyOps
array of strings

Allowed key operations

keyOps
string
enum

Cryptographic purpose. Optional — Core-API derives it from the algorithm's key operations when unambiguous. REQUIRED for ambiguous algorithms whose key operations span both families (RSA, EC): supplying it narrows the operations sent to Core-API to that purpose's family so Core-API can resolve the purpose without returning 422 purpose-required. When omitted for an ambiguous algorithm, the Core-API 422 backstop applies.

Allowed:
metadata
object

Optional metadata

string

Optional expiration timestamp (ISO-8601 Instant). Defaults to creation time + 2 years if omitted. Must be in the future when specified.

boolean

Whether the new key's public key may be exported (gates GET /keys/{kid}/export). Optional; when omitted the backend default (false) applies.

int32
≥ 0

Hard usage cap; 0 or null = unlimited; must not be negative. Optional; forwarded to Core-API, which owns the default and enforcement.

int32
≥ 0

Soft usage warning threshold; must be less than maxUsageLimit (server-enforced); 0 or null = no soft threshold; must not be negative. Optional; forwarded to Core-API, which owns the soft<max validation.

string

Optional soft/warning expiry timestamp (ISO-8601 Instant); must be before expiresAt (server-enforced); null or omitted = no soft expiry. Optional; forwarded raw to Core-API, which owns the ordering validation.

Headers
string
enum
Defaults to application/json

Generated from available response content types

Allowed:
Responses

Updated 11 days ago

Did this page help you?
Language
Credentials
Bearer
JWT
URL
LoadingLoading…
Response
Click Try It! to start a request and see the response here! Or choose an example:
application/json
application/problem+json

Updated 11 days ago

Did this page help you?