# Create a new Access Key ```http POST https://mgmt.storage.dev/v1/providers/:provider_id/orgs/:org_id/key ``` Creates a new access key for a user. The access key ID and secret will be returned in the response. ## Request ### Path Parameters **provider_id** string required Provider ID **org_id** string required Organization ID - application/json - Body - Example (auto) ### Body **required** **name** string Name of the access key **user_id** string required ID of the user for whom the access key is being created **user_role** OrgMembership Role of the user in the organization. Controls what the user can do through the Partner API management endpoints. - `Admin`: Full org access. Can list and manage all access keys in the org, update org settings, and manage users. ListAccessKeys returns all keys in the org. - `Member`: Standard access. Can only manage their own access keys. ListAccessKeys returns only keys owned by this user. If omitted, defaults to `Member` behavior. **Possible values:** [`Admin`, `Member`] **buckets_roles** object[] Array [ **bucket_name** string required Name of the bucket **role** string required The role defines the permissions for the associated bucket: - `ReadOnly`: Read-only access to the bucket. Permits read operations like GetObject, HeadObject, ListObjects. - `Editor`: Read and write access to the bucket. Includes everything in ReadOnly, plus PutObject, DeleteObject, and bucket configuration operations. - `Admin`: Full access to all buckets in the org, bypasses all permission checks. When used with `bucket_name: "*"`, the access key is treated as a full org admin. The value of `bucket_name` should always be `*` when using this role. Example: ```json { "bucket_name": "*", "role": "Admin" } ``` **Possible values:** [`ReadOnly`, `Editor`, `Admin`] ] **attach_policies** string[] Names of existing IAM policies to attach to this access key. All policies must already exist — if any policy name is invalid, the request fails and no key is created. **create_policies** object[] New IAM policies to create and attach to this access key. Each policy is created first, then attached atomically. If a policy with the same name already exists the request fails — use attach_policies to reuse an existing policy. If policy document validation fails, no key is created. Array [ **name** string required Name of the policy. Must be unique within the organization. Only alphanumeric characters and `+=,.@_-` are allowed. **Possible values:**`<= 128 characters` **document** object required AWS IAM-compatible policy document. See [IAM Policies documentation](/content/docs/iam/policies/index.html) for details. **Version** string required Policy language version. **Possible values:** [`2012-10-17`] **Statement** object[] required Array [ **Sid** string Optional identifier for the statement **Effect** string required Whether this statement allows or denies the specified actions **Possible values:** [`Allow`, `Deny`] **Action** string[] required S3 actions to allow or deny. Common actions: `s3:GetObject`, `s3:PutObject`, `s3:DeleteObject`, `s3:ListBucket`, `s3:*`. See [supported actions](/content/docs/iam/policies/supported-actions/index.html). **Resource** string[] required S3 resource ARNs. Use `arn:aws:s3:::bucket` for bucket-level and `arn:aws:s3:::bucket/prefix/*` for prefix-scoped access. **Condition** object Optional conditions (IP, time-based). See [condition examples](/content/docs/iam/policies/examples/ip-restrictions/index.html). ] **description** string A description for the policy **Possible values:**`<= 1000 characters` ] **access_key_scope** AccessKeyScope Controls whether the key receives the implicit default-allowed operations (such as create bucket or list buckets) on top of what its policies and bucket roles grant. - `standard` (default): grants the default-allowed operations. - `no_default_allow`: denies them, so the key can do only what its policies and bucket roles explicitly allow. **Possible values:** [`standard`, `no_default_allow`] ```json { "name": "string", "user_id": "string", "user_role": "Admin", "buckets_roles": [ { "bucket_name": "string", "role": "ReadOnly" } ], "attach_policies": [ "string" ], "create_policies": [ { "name": "string", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "string", "Effect": "Allow", "Action": [ "string" ], "Resource": [ "string" ], "Condition": {} } ] }, "description": "string" } ], "access_key_scope": "standard" } ``` ## Responses - 200 - default OK - application/json - Schema - Example (auto) **Schema** **id** string required Access key ID **secret_key** string required Access secret **name** string Name of the access key ```json { "id": "string", "secret_key": "string", "name": "string" } ``` Unexpected error - application/json - Schema - Example (auto) **Schema** **message** string ```json { "message": "string" } ``` #### Authorization: X-Tigris-Signature ``` name: X-Tigris-Signature type: apiKey in: header description: HMAC-SHA256 of the canonical request signed using the signing key. To create the signature, concatenate the HTTP method, URL, timestamp, and nonce with a newline character in between. Then, calculate the HMAC-SHA256 of the concatenated string using the signing key. Example: Create the `canonical_request` as: ``` POST https://mgmt.storage.dev/provider/your-provider-id/orgs/user-org-id/provision 1731703213870 f8d133cb-5a42-47b1-9ef2-874bb55bab72 ``` Then, calculate HMAC-SHA256 of the canonical request using the signing key as: ``` Signature = hex(sha256sign(canonical_request, "signing_key")) ``` ``` ``` name: X-Tigris-Nonce type: apiKey in: header description: Random unique string to identify the request and prevent replay attacks. Example: "f8d133cb-5a42-47b1-9ef2-874bb55bab72" ``` ``` name: X-Tigris-Time type: apiKey in: header description: Unix timestamp in milliseconds of the request. Example: 1731703213870 ``` - csharp - curl - dart - go - http - java - javascript - kotlin - c - nodejs - objective-c - ocaml - php - postman-cli - powershell - python - r - ruby - rust - shell - swift - HTTPCLIENT - RESTSHARP ```csharp var client = new HttpClient(); var request = new HttpRequestMessage(HttpMethod.Post, "https://mgmt.storage.dev/v1/providers/:provider_id/orgs/:org_id/key"); request.Headers.Add("Accept", "application/json"); request.Headers.Add("X-Tigris-Signature", ""); request.Headers.Add("X-Tigris-Nonce", ""); request.Headers.Add("X-Tigris-Time", ""); var content = new StringContent("{\n \"name\": \"string\",\n \"user_id\": \"string\",\n \"user_role\": \"Admin\",\n \"buckets_roles\": [\n {\n \"bucket_name\": \"string\",\n \"role\": \"ReadOnly\"\n }\n ],\n \"attach_policies\": [\n \"string\"\n ],\n \"create_policies\": [\n {\n \"name\": \"string\",\n \"document\": {\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Sid\": \"string\",\n \"Effect\": \"Allow\",\n \"Action\": [\n \"string\"\n ],\n \"Resource\": [\n \"string\"\n ],\n \"Condition\": {}\n }\n ]\n },\n \"description\": \"string\"\n }\n ],\n \"access_key_scope\": \"standard\"\n}", null, "application/json"); request.Content = content; var response = await client.SendAsync(request); response.EnsureSuccessStatusCode(); Console.WriteLine(await response.Content.ReadAsStringAsync()); ``` Request Collapse all Base URL Edit https://mgmt.storage.dev Auth Signature Nonce Timestamp Parameters provider_id — path required org_id — path required Body required Send API Request Response Clear Click the `Send API Request` button above and see the response here!