Create an API key

Creates a new API key in the caller’s tenant. The plaintext key field is returned once in the response — the server never shows it again. Store it securely; rotating means revoking the old key and creating a new one.

role controls scope: admin bypasses every permission check; tenant_admin is the admin tier within a tenant; member is scoped by the three permission maps (type_permissions, extension_permissions, edge_permissions) plus metadata_permissions. source is stamped onto every item written by the key and is unique per tenant. default_tier stamps library or feed when the writing client omits a tier.

In bootstrap mode (zero keys exist on a fresh server), no auth is required and the minted key is always admin. Once any key exists, bootstrap mode disables — further key creation requires an admin or tenant_admin token. See Permissions for the permission-map grammar.