Create a new Access Key | Tigris Object Storage Documentation

Create a new Access Key

POST https://mgmt.storage.dev/v1/providers/:provider_id/orgs/:org_id/key

Creates a new access key for a user. The access key ID and secret will be returned in the response.

Request

Path Parameters

provider_id string required
Provider ID

org_id string required
Organization ID

application/json
Body
Example (auto)

Body required

name string
Name of the access key

user_id string required
ID of the user for whom the access key is being created

user_role OrgMembership
Role of the user in the organization. Controls what the user can do through the Partner API management endpoints.

Admin: Full org access. Can list and manage all access keys in the org, update org settings, and manage users. ListAccessKeys returns all keys in the org.
Member: Standard access. Can only manage their own access keys. ListAccessKeys returns only keys owned by this user.

If omitted, defaults to Member behavior.

Possible values: [Admin, Member]

buckets_roles object[]
Array [

bucket_name string required

Name of the bucket

role string required

The role defines the permissions for the associated bucket:

ReadOnly: Read-only access to the bucket. Permits read operations like GetObject, HeadObject, ListObjects.
Editor: Read and write access to the bucket. Includes everything in ReadOnly, plus PutObject, DeleteObject, and bucket configuration operations.
Admin: Full access to all buckets in the org, bypasses all permission checks. When used with bucket_name: "*", the access key is treated as a full org admin. The value of bucket_name should always be * when using this role.

Example:

{  
    "bucket_name": "*",  
    "role": "Admin"  
}

Possible values: [ReadOnly, Editor, Admin]

]

attach_policies string[]
Names of existing IAM policies to attach to this access key. All policies must already exist — if any policy name is invalid, the request fails and no key is created.

create_policies object[]
New IAM policies to create and attach to this access key. Each policy is created first, then attached atomically. If a policy with the same name already exists the request fails — use attach_policies to reuse an existing policy. If policy document validation fails, no key is created.
Array [

name string required

Name of the policy. Must be unique within the organization. Only alphanumeric characters and +=,.@_- are allowed.

Possible values:<= 128 characters

document object required

AWS IAM-compatible policy document. See IAM Policies documentation for details.

Version string required

Policy language version.

Possible values: [2012-10-17]

Statement object[] required

Array [

**Sid** string  

Optional identifier for the statement  

**Effect** string required  

Whether this statement allows or denies the specified actions  

**Possible values:** [`Allow`, `Deny`]  

**Action** string[] required  

S3 actions to allow or deny. Common actions: `s3:GetObject`, `s3:PutObject`, `s3:DeleteObject`, `s3:ListBucket`, `s3:*`. See [supported actions](/content/docs/iam/policies/supported-actions/index.html).  

**Resource** string[] required  

S3 resource ARNs. Use `arn:aws:s3:::bucket` for bucket-level and `arn:aws:s3:::bucket/prefix/*` for prefix-scoped access.  

**Condition** object  

Optional conditions (IP, time-based). See [condition examples](/content/docs/iam/policies/examples/ip-restrictions/index.html).

]

description string

A description for the policy

Possible values:<= 1000 characters

]

access_key_scope AccessKeyScope
Controls whether the key receives the implicit default-allowed operations (such as create bucket or list buckets) on top of what its policies and bucket roles grant.

standard (default): grants the default-allowed operations.
no_default_allow: denies them, so the key can do only what its policies and bucket roles explicitly allow.

Possible values: [standard, no_default_allow]

{  
  "name": "string",  
  "user_id": "string",  
  "user_role": "Admin",  
  "buckets_roles": [  
    {  
      "bucket_name": "string",  
      "role": "ReadOnly"  
    }  
  ],  
  "attach_policies": [  
    "string"  
  ],  
  "create_policies": [  
    {  
      "name": "string",  
      "document": {  
        "Version": "2012-10-17",  
        "Statement": [  
          {  
            "Sid": "string",  
            "Effect": "Allow",  
            "Action": [  
              "string"  
            ],  
            "Resource": [  
              "string"  
            ],  
            "Condition": {}  
          }  
        ]  
      },  
      "description": "string"  
    }  
  ],  
  "access_key_scope": "standard" 
}

Responses

200
default

application/json
Schema
Example (auto)

Schema

id string required
Access key ID

secret_key string required
Access secret

name string
Name of the access key

{  
  "id": "string",  
  "secret_key": "string",  
  "name": "string"  
}

Unexpected error

application/json
Schema
Example (auto)

Schema

message string

{  
  "message": "string"  
}

Authorization: X-Tigris-Signature

name: X-Tigris-Signature  
type: apiKey  
in: header  
description: HMAC-SHA256 of the canonical request signed using the signing key. To create the signature, concatenate the HTTP method, URL, timestamp, and nonce with a newline character in between. Then, calculate the HMAC-SHA256 of the concatenated string using the signing key. Example:

Create the `canonical_request` as:

POST https://mgmt.storage.dev/provider/your-provider-id/orgs/user-org-id/provision 1731703213870 f8d133cb-5a42-47b1-9ef2-874bb55bab72

Then, calculate HMAC-SHA256 of the canonical request using the signing key as:

Signature = hex(sha256sign(canonical_request, "signing_key"))

name: X-Tigris-Nonce  
type: apiKey  
in: header  
description: Random unique string to identify the request and prevent replay attacks. Example: "f8d133cb-5a42-47b1-9ef2-874bb55bab72"

name: X-Tigris-Time  
type: apiKey  
in: header  
description: Unix timestamp in milliseconds of the request. Example: 1731703213870

csharp
curl
dart
go
http
java
javascript
kotlin
c
nodejs
objective-c
ocaml
php
postman-cli
powershell
python
r
ruby
rust
shell
swift
HTTPCLIENT
RESTSHARP

var client = new HttpClient();
var request = new HttpRequestMessage(HttpMethod.Post, "https://mgmt.storage.dev/v1/providers/:provider_id/orgs/:org_id/key");
request.Headers.Add("Accept", "application/json");
request.Headers.Add("X-Tigris-Signature", "<X-Tigris-Signature>");
request.Headers.Add("X-Tigris-Nonce", "<X-Tigris-Nonce>");
request.Headers.Add("X-Tigris-Time", "<X-Tigris-Time>");
var content = new StringContent("{\n  \"name\": \"string\",\n  \"user_id\": \"string\",\n  \"user_role\": \"Admin\",\n  \"buckets_roles\": [\n    {\n      \"bucket_name\": \"string\",\n      \"role\": \"ReadOnly\"\n    }\n  ],\n  \"attach_policies\": [\n    \"string\"\n  ],\n  \"create_policies\": [\n    {\n      \"name\": \"string\",\n      \"document\": {\n        \"Version\": \"2012-10-17\",\n        \"Statement\": [\n          {\n            \"Sid\": \"string\",\n            \"Effect\": \"Allow\",\n            \"Action\": [\n              \"string\"\n            ],\n            \"Resource\": [\n              \"string\"\n            ],\n            \"Condition\": {}\n          }\n        ]\n      },\n      \"description\": \"string\"\n    }\n  ],\n  \"access_key_scope\": \"standard\"\n}", null, "application/json");
request.Content = content;
var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

Request Collapse all

Base URL

Edit

https://mgmt.storage.dev

Auth

Signature

Nonce

Timestamp

Parameters

provider_id — path required

org_id — path required

Body required

Send API Request

Response Clear

Click the Send API Request button above and see the response here!