Create an Organization API Key

POST /organization-pats

Create Pat

cURL

curl --request POST \
  --url https://api.example.com/organization-pats \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "name": "<string>",
  "expires_at": 123
}
'

200

{
  "id": "<string>",
  "name": "<string>",
  "key_id": "<string>",
  "pat_key": "<string>",
  "expires_at": "<string>",
  "created_at": "<string>",
  "owner_user_id": "<string>",
  "owner_name": "<string>"
}

Requires an active organization — without one, the org lookup this performs fails and the request returns 404 rather than proceeding. The secret is generated here, hashed with Argon2id, and stored in the pats table (org-scoped by row-level security). Creates the paired Logto personal access token first, then the local pats row; if the local insert fails, the Logto token is deleted to avoid leaving an orphaned credential.

Auth

Requires pats:create and an active organization, since the key is created under the token’s organization. Every default role carries pats:create: the key is minted under the caller’s own Logto user and, at exchange, carries only that user’s scopes, so it can’t grant more access than the caller already has.

Response

200 OK — same shape as one element of the List Organization API Keys response, except:

Field	Type	Description
pat_key	string	The full secret, ak_<key_id>.<secret> — shown exactly once. Store it now; it cannot be retrieved again.

Errors

Status	Cause
404 Not Found	The token’s organization claim doesn’t resolve to a known AnyCRM organization (Organization not found for logto_org_id=...) — typically means no active organization was selected.

Authorizations

Authorization · string · header · required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Body

application/json

name · string · required

Label for the org API key, shown in Settings → Tokens.

expires_at · integer | null

Optional expiry as epoch milliseconds (not seconds — a value below 10^12 is rejected). Omit for a key that never expires.

Response

200

application/json

Successful Response

id · string · required

name · string · required

key_id · string · required

pat_key · string | null

expires_at · string | null

created_at · string | null

owner_user_id · string | null

owner_name · string | null