Create API client

POST

/api/user/api-clients

curl --request POST \
  --url https://hitkeep.com/api/user/api-clients \
  --header 'Content-Type: application/json' \
  --cookie hk_token=<hk_token> \
  --data '{ "description": "example", "expires_at": "2026-04-15T12:00:00Z", "instance_role": "example", "name": "example", "site_roles": [ { "role": "example", "site_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0" } ] }'

Creates delegated API client and returns one-time token. Site analytics, MCP, and ingest access require explicit site_roles grants.

Authorizations

• cookieAuth

Request Body ^required

Media type application/json

object

description

string

expires_at

string format: date-time

instance_role

string

name

required

string

site_roles

Array<object>

object

role

string

site_id

string format: uuid

Example ^generated

{
  "description": "example",
  "expires_at": "2026-04-15T12:00:00Z",
  "instance_role": "example",
  "name": "example",
  "site_roles": [
    {
      "role": "example",
      "site_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0"
    }
  ]
}

Responses

201

Created API client

Media type application/json

object

client

object

created_at

string format: date-time

description

string

expires_at

string format: date-time

id

string format: uuid

instance_role

string

last_used_at

string format: date-time

name

string

owner_type

string

Allowed values: personal team

revoked_at

string format: date-time

site_roles

Explicit site grants. Empty means the API client has no site-scoped analytics, MCP, or ingest access.

Array<object>

object

role

string

site_id

string format: uuid

tenant_id

string format: uuid

updated_at

string format: date-time

user_id

string format: uuid

token

string

Example

{
  "client": {
    "owner_type": "personal"
  }
}