MCP tool

Create API key

sosoapi_create_api_key

Create a personal access key with chosen capabilities (agent:operate, agent:publish, agent:engage), an optional workspace_ids limit and a lifetime of up to 365 days; the secret is returned once and cannot be read again. An agent can grant only what its own authorization holds, for at most 30 days, and the key stops working when that grant ends. Needs the Manage API keys grant; a PAT cannot use it.

Read as Markdown

Profiles and transports

Profiles: full · Transports: stdio, http

Choose core or full to control which tools your client sees; this does not change its permissions. Local file upload requires stdio and is unavailable over HTTP. Set SOSOAPI_OUTPUT_SCHEMAS=1 to include output schemas in discovery. Tools return structured results with or without that setting.

Permissions and side effects

Annotations help clients describe a tool. Each call still checks the user’s authentication, role, resource access and capability grants.

{
  "readOnlyHint": false,
  "destructiveHint": false,
  "idempotentHint": false,
  "openWorldHint": false
}

/identity-api/api-keys/create: agent:manage_api_keys · synchronous_http_response

Input fields

Required means required inside its parent object and selected branch. A required child does not make an optional parent required. Rules and field names below are copied from the contract.

Input fields
Field / branch	Type / required	Constraints
`$`	`object`Required in parent	`additionalProperties: false`
`name`	`string`Required in parent	`minLength: 1` `maxLength: 80`
`lifetime_days`	`integer`Optional / item	Days until the key expires (1-365, default 365). A key created by a delegated agent never lives longer than 30 days. `minimum: 1` `maximum: 365`
`capabilities`	`array`Optional / item	What the key may do. Defaults to operate, publish and engage for a signed-in user. A delegated agent can only grant what its own authorization holds (never key management). `minItems: 1` `maxItems: 3`
`capabilities[]`	`string`Optional / item	`enum: ["agent:operate","agent:publish","agent:engage"]`
`workspace_ids`	`array`Optional / item	Limit the key to these Workspaces. Omit it for every Workspace the user can access. A limited key must name its Workspace (workspace_id) on routes that would otherwise use the active Workspace, and cannot call organization-wide reads. `minItems: 1` `maxItems: 100`
`workspace_ids[]`	`string`Optional / item	`format: "uuid"`
`scopes`	`array`Optional / item	Deprecated alias of capabilities. It is honoured exactly; an empty list is ignored. `maxItems: 3`
`scopes[]`	`string`Optional / item	`enum: ["agent:operate","agent:publish","agent:engage"]`
`idempotency_key`	`string`Optional / item	Optional. Reuse the same key to retry safely. The secret is shown once: a retry that finds the key already created answers 409 IDEMPOTENT_REPLAY (details.existing_key names it) instead of showing it again. Revoke that key and create a new one with a new idempotency_key. `minLength: 8` `maxLength: 160` `pattern: "^[!-~]+$"`

Complete JSON Schema

{
  "type": "object",
  "properties": {
    "name": {
      "type": "string",
      "minLength": 1,
      "maxLength": 80
    },
    "lifetime_days": {
      "description": "Days until the key expires (1-365, default 365). A key created by a delegated agent never lives longer than 30 days.",
      "type": "integer",
      "minimum": 1,
      "maximum": 365
    },
    "capabilities": {
      "description": "What the key may do. Defaults to operate, publish and engage for a signed-in user. A delegated agent can only grant what its own authorization holds (never key management).",
      "minItems": 1,
      "maxItems": 3,
      "type": "array",
      "items": {
        "type": "string",
        "enum": [
          "agent:operate",
          "agent:publish",
          "agent:engage"
        ]
      }
    },
    "workspace_ids": {
      "description": "Limit the key to these Workspaces. Omit it for every Workspace the user can access. A limited key must name its Workspace (workspace_id) on routes that would otherwise use the active Workspace, and cannot call organization-wide reads.",
      "minItems": 1,
      "maxItems": 100,
      "type": "array",
      "items": {
        "type": "string",
        "format": "uuid"
      }
    },
    "scopes": {
      "description": "Deprecated alias of capabilities. It is honoured exactly; an empty list is ignored.",
      "maxItems": 3,
      "type": "array",
      "items": {
        "type": "string",
        "enum": [
          "agent:operate",
          "agent:publish",
          "agent:engage"
        ]
      }
    },
    "idempotency_key": {
      "description": "Optional. Reuse the same key to retry safely. The secret is shown once: a retry that finds the key already created answers 409 IDEMPOTENT_REPLAY (details.existing_key names it) instead of showing it again. Revoke that key and create a new one with a new idempotency_key.",
      "type": "string",
      "minLength": 8,
      "maxLength": 160,
      "pattern": "^[!-~]+$"
    }
  },
  "required": [
    "name"
  ],
  "additionalProperties": false
}

Structured output

This schema describes structuredContent in a successful tool result. The MCP response also includes content and may set isError when a call fails. For publishing, read the post’s final result rather than treating an accepted request or text response as confirmation. The linked API operation explains permissions and retry rules.

Required means required inside its parent object and selected branch. A required child does not make an optional parent required. Rules and field names below are copied from the contract.

Structured output
Field / branch	Type / required	Constraints
`$`	`object`Required in parent	`additionalProperties: false`
`apiKey`	`object`Required in parent	`additionalProperties: false`
`apiKey.id`	`string`Required in parent	`format: "uuid"`
`apiKey.name`	`string`Required in parent	—
`apiKey.last_4`	`string`Required in parent	—
`apiKey.scopes`	`array`Required in parent	—
`apiKey.scopes[]`	`string`Optional / item	—
`apiKey.created_at`	`string`Required in parent	`format: "date-time"` `pattern: "^(?:(?:\\d\\d[2468][048]\|\\d\\d[13579][26]\|\\d\\d0[48]\|[02468][048]00\|[13579][26]00)-02-29\|\\d{4}-(?:(?:0[13578]\|1[02])-(?:0[1-9]\|[12]\\d\|3[01])\|(?:0[469]\|11)-(?:0[1-9]\|[12]\\d\|30)\|(?:02)-(?:0[1-9]\|1\\d\|2[0-8])))T(?:(?:[01]\\d\|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z\|([+-](?:[01]\\d\|2[0-3]):[0-5]\\d)))$"`
`apiKey.expires_at`	`string \| null`Required in parent	—
`apiKey.expires_at`anyOf 1	`string`Required in parent	`format: "date-time"` `pattern: "^(?:(?:\\d\\d[2468][048]\|\\d\\d[13579][26]\|\\d\\d0[48]\|[02468][048]00\|[13579][26]00)-02-29\|\\d{4}-(?:(?:0[13578]\|1[02])-(?:0[1-9]\|[12]\\d\|3[01])\|(?:0[469]\|11)-(?:0[1-9]\|[12]\\d\|30)\|(?:02)-(?:0[1-9]\|1\\d\|2[0-8])))T(?:(?:[01]\\d\|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z\|([+-](?:[01]\\d\|2[0-3]):[0-5]\\d)))$"`
`apiKey.expires_at`anyOf 2	`null`Required in parent	—
`apiKey.last_used_at`	`string \| null`Required in parent	—
`apiKey.last_used_at`anyOf 1	`string`Required in parent	`format: "date-time"` `pattern: "^(?:(?:\\d\\d[2468][048]\|\\d\\d[13579][26]\|\\d\\d0[48]\|[02468][048]00\|[13579][26]00)-02-29\|\\d{4}-(?:(?:0[13578]\|1[02])-(?:0[1-9]\|[12]\\d\|3[01])\|(?:0[469]\|11)-(?:0[1-9]\|[12]\\d\|30)\|(?:02)-(?:0[1-9]\|1\\d\|2[0-8])))T(?:(?:[01]\\d\|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z\|([+-](?:[01]\\d\|2[0-3]):[0-5]\\d)))$"`
`apiKey.last_used_at`anyOf 2	`null`Required in parent	—
`apiKey.revoked_at`	`string \| null`Required in parent	—
`apiKey.revoked_at`anyOf 1	`string`Required in parent	`format: "date-time"` `pattern: "^(?:(?:\\d\\d[2468][048]\|\\d\\d[13579][26]\|\\d\\d0[48]\|[02468][048]00\|[13579][26]00)-02-29\|\\d{4}-(?:(?:0[13578]\|1[02])-(?:0[1-9]\|[12]\\d\|3[01])\|(?:0[469]\|11)-(?:0[1-9]\|[12]\\d\|30)\|(?:02)-(?:0[1-9]\|1\\d\|2[0-8])))T(?:(?:[01]\\d\|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z\|([+-](?:[01]\\d\|2[0-3]):[0-5]\\d)))$"`
`apiKey.revoked_at`anyOf 2	`null`Required in parent	—
`apiKey.status`	`string`Required in parent	`enum: ["active","expired","revoked"]`
`apiKey.replaces`	`object \| null`Required in parent	—
`apiKey.replaces`anyOf 1	`object`Required in parent	`additionalProperties: false`
`apiKey.replaces.id`anyOf 1	`string`Required in parent	`format: "uuid"`
`apiKey.replaces.name`anyOf 1	`string`Required in parent	—
`apiKey.replaces.last_4`anyOf 1	`string`Required in parent	—
`apiKey.replaces.status`anyOf 1	`string`Required in parent	`enum: ["active","expired","revoked"]`
`apiKey.replaces`anyOf 2	`null`Required in parent	—
`apiKey.replaced_by`	`array`Required in parent	—
`apiKey.replaced_by[]`	`object`Optional / item	`additionalProperties: false`
`apiKey.replaced_by[].id`	`string`Required in parent	`format: "uuid"`
`apiKey.replaced_by[].name`	`string`Required in parent	—
`apiKey.replaced_by[].last_4`	`string`Required in parent	—
`apiKey.replaced_by[].status`	`string`Required in parent	`enum: ["active","expired","revoked"]`
`apiKey.capabilities`	`array`Optional / item	—
`apiKey.capabilities[]`	`string`Optional / item	`enum: ["agent:operate","agent:publish","agent:engage"]`
`apiKey.workspace_ids`	`array \| null`Optional / item	—
`apiKey.workspace_ids`anyOf 1	`array`Optional / item	—
`apiKey.workspace_ids[]`anyOf 1	`string`Optional / item	`format: "uuid"`
`apiKey.workspace_ids`anyOf 2	`null`Optional / item	—
`apiKey.created_by_delegated_grant_id`	`string \| null`Optional / item	—
`apiKey.created_by_delegated_grant_id`anyOf 1	`string`Optional / item	`format: "uuid"`
`apiKey.created_by_delegated_grant_id`anyOf 2	`null`Optional / item	—
`secret`	`string`Required in parent	`minLength: 1`

Complete JSON Schema

{
  "type": "object",
  "properties": {
    "apiKey": {
      "type": "object",
      "properties": {
        "id": {
          "type": "string",
          "format": "uuid"
        },
        "name": {
          "type": "string"
        },
        "last_4": {
          "type": "string"
        },
        "scopes": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "created_at": {
          "type": "string",
          "format": "date-time",
          "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$"
        },
        "expires_at": {
          "anyOf": [
            {
              "type": "string",
              "format": "date-time",
              "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$"
            },
            {
              "type": "null"
            }
          ]
        },
        "last_used_at": {
          "anyOf": [
            {
              "type": "string",
              "format": "date-time",
              "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$"
            },
            {
              "type": "null"
            }
          ]
        },
        "revoked_at": {
          "anyOf": [
            {
              "type": "string",
              "format": "date-time",
              "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$"
            },
            {
              "type": "null"
            }
          ]
        },
        "status": {
          "type": "string",
          "enum": [
            "active",
            "expired",
            "revoked"
          ]
        },
        "replaces": {
          "anyOf": [
            {
              "type": "object",
              "properties": {
                "id": {
                  "type": "string",
                  "format": "uuid"
                },
                "name": {
                  "type": "string"
                },
                "last_4": {
                  "type": "string"
                },
                "status": {
                  "type": "string",
                  "enum": [
                    "active",
                    "expired",
                    "revoked"
                  ]
                }
              },
              "required": [
                "id",
                "name",
                "last_4",
                "status"
              ],
              "additionalProperties": false
            },
            {
              "type": "null"
            }
          ]
        },
        "replaced_by": {
          "type": "array",
          "items": {
            "type": "object",
            "properties": {
              "id": {
                "type": "string",
                "format": "uuid"
              },
              "name": {
                "type": "string"
              },
              "last_4": {
                "type": "string"
              },
              "status": {
                "type": "string",
                "enum": [
                  "active",
                  "expired",
                  "revoked"
                ]
              }
            },
            "required": [
              "id",
              "name",
              "last_4",
              "status"
            ],
            "additionalProperties": false
          }
        },
        "capabilities": {
          "type": "array",
          "items": {
            "type": "string",
            "enum": [
              "agent:operate",
              "agent:publish",
              "agent:engage"
            ]
          }
        },
        "workspace_ids": {
          "anyOf": [
            {
              "type": "array",
              "items": {
                "type": "string",
                "format": "uuid"
              }
            },
            {
              "type": "null"
            }
          ]
        },
        "created_by_delegated_grant_id": {
          "anyOf": [
            {
              "type": "string",
              "format": "uuid"
            },
            {
              "type": "null"
            }
          ]
        }
      },
      "required": [
        "id",
        "name",
        "last_4",
        "scopes",
        "created_at",
        "expires_at",
        "last_used_at",
        "revoked_at",
        "status",
        "replaces",
        "replaced_by"
      ],
      "additionalProperties": false
    },
    "secret": {
      "type": "string",
      "minLength": 1
    }
  },
  "required": [
    "apiKey",
    "secret"
  ],
  "$schema": "http://json-schema.org/draft-07/schema#",
  "additionalProperties": false
}

Example tool call

These examples use fictional values checked against the schemas. Replace the IDs with ones you are authorized to use, the media with ready assets and the dates with your confirmed publishing time. Check the account’s eligibility before submitting a write. This page sends no API requests.

{
  "name": "sosoapi_create_api_key",
  "arguments": {
    "name": "example"
  }
}

structuredContent

{
  "apiKey": {
    "id": "11111111-1111-4111-8111-111111111111",
    "name": "example",
    "last_4": "example",
    "scopes": [],
    "created_at": "2099-01-15T09:00:00Z",
    "expires_at": null,
    "last_used_at": null,
    "revoked_at": null,
    "status": "active",
    "replaces": null,
    "replaced_by": []
  },
  "secret": "example"
}

/identity-api/api-keys/create

Install or connect MCP