/me/api-keys - Create an API key

Add MCP server to your AI tool

Allow AI tools and LLMs to interact with the API documentation portal through MCP.

MCP server URL

https://api.my.nethesis.it/mcp

Standard setup for AI tools providing an mcp.json file

mcp.json 
{
  "my.nethesis.it MCP server": {
    "url": "https://api.my.nethesis.it/mcp"
  }
}
Close
POST /me/api-keys
Bearer auth

Issue a personal API key for non-interactive integrations. The full plaintext token is returned exactly once and never again. A user may hold at most 5 active keys. Interactive-session only — cannot be called with an API key.

application/json

Body Required

  • name string Required

    Human label for the integration this key serves

  • mode string Required

    Values are read or write.

  • expires_in_days integer

    Optional. Defaults to 90, capped at 365.

    Minimum value is 1, maximum value is 365.

  • password string(password) Required

    The caller's current password, re-verified as a step-up before the key is minted.

Responses

  • 201 application/json

    API key created successfully

    Hide response attributes Show response attributes object
    • code integer
    • message string
    • data object

      A personal API key. The secret part of the token is never returned after creation.

      Hide data attributes Show data attributes object
      • id string
      • user_id string

        Local database ID of the owner

      • organization_id string
      • name string

        Human label for the integration this key serves

      • key_public string

        Public part of the token (for display/identification only)

      • mode string

        read = read:* only; write = read:* + manage:* (destroy/impersonate/alert-config excluded)

        Values are read or write.

      • expires_at string(date-time)
      • last_used_at string(date-time) | null
      • last_used_ip string | null
      • revoked_at string(date-time) | null
      • created_at string(date-time)
      • token string

        The full plaintext token, shown exactly once. Store it now — it is never returned again.
  • 400 application/json

    Bad request - validation error

    Hide response attributes Show response attributes object
    • code integer

      HTTP error code

    • message string

      Error message

    • data object
      Hide data attributes Show data attributes object
      • type string

        Type of error

        Values are validation_error or external_api_error.

      • errors array[object]
        Hide errors attributes Show errors attributes object
        • key string

          Field name that failed validation

        • message string

          Error code or message

        • value string

          Value that failed validation

      • details

        Additional error details
  • 401 application/json

    Unauthorized - invalid or missing token

    Hide response attributes Show response attributes object
    • code integer
    • message string
    • data object | null
  • 403 application/json

    Forbidden - insufficient permissions

    Hide response attributes Show response attributes object
    • code integer
    • message string
    • data object | null
  • 409 application/json

    Maximum number of active API keys reached (translatable validation error)

    Hide response attributes Show response attributes object
    • code integer
    • message string
    • data object
      Hide data attributes Show data attributes object
      • type string

        Value is validation_error.

      • errors array[object]
        Hide errors attributes Show errors attributes object
        • key string
        • message string

          Error code the UI maps to a localized message
  • 500 application/json

    Internal server error

    Hide response attributes Show response attributes object
    • code integer
    • message string
    • data object | null
POST /me/api-keys 
curl \
 --request POST 'https://api.your-domain.com/api/me/api-keys' \
 --header "Authorization: Bearer $ACCESS_TOKEN" \
 --header "Content-Type: application/json" \
 --data '{"name":"CRM production","mode":"read","expires_in_days":90,"password":"S3cr3t-Passw0rd!"}'
Request examples 
{
  "name": "CRM production",
  "mode": "read",
  "expires_in_days": 90,
  "password": "S3cr3t-Passw0rd!"
}
Response examples (201) 
{
  "code": 201,
  "message": "api key created successfully",
  "data": {
    "id": "f47ac10b-58cc-4372-a567-0e02b2c3d479",
    "user_id": "jf584cz36kce",
    "organization_id": "org_a1b2c3",
    "name": "CRM production",
    "key_public": "a1b2c3d4e5f60718293a4b5c",
    "mode": "read",
    "expires_at": "2026-05-04T09:42:00Z",
    "last_used_at": "2026-05-04T09:42:00Z",
    "last_used_ip": "string",
    "revoked_at": "2026-05-04T09:42:00Z",
    "created_at": "2026-05-04T09:42:00Z",
    "token": "myk_a1b2c3d4e5f60718293a4b5c.0011223344556677889900aabbccddeeff00112233445566"
  }
}
Response examples (400) 
{
  "code": 400,
  "message": "validation failed",
  "data": {
    "type": "validation_error",
    "errors": [
      {
        "key": "username",
        "message": "required",
        "value": "string"
      }
    ]
  }
}
Response examples (401) 
{
  "code": 401,
  "message": "invalid token",
  "data": {}
}
Response examples (403) 
{
  "code": 403,
  "message": "insufficient permissions",
  "data": {}
}
Response examples (409) 
{
  "code": 409,
  "message": "validation failed",
  "data": {
    "type": "validation_error",
    "errors": [
      {
        "key": "limit",
        "message": "max_keys_reached"
      }
    ]
  }
}
Response examples (500) 
{
  "code": 500,
  "message": "internal server error",
  "data": {}
}