# Create a credential

`POST https://api.cademi.com.br/api/v3/credentials`

Operation ID: `credentials.create` · API v3

Issues a new API credential for the current account and, optionally, its initial access policies.

Each entry in `policies` specifies either a list of `capabilities` or a policy `template`, together with the `resources` it applies to. Available templates are returned by the list policy templates operation.

The credential secret is returned only in this response and cannot be retrieved again. Store it securely.

The new credential cannot receive permissions beyond those the calling credential is allowed to delegate. Such requests are rejected with `delegation_limit_exceeded` and no credential is issued.

Required permissions: `credentials.manage`.

## Parameters

| Name | In | Type | Required | Description |
|---|---|---|---|---|
| `Idempotency-Key` | header | string | yes |  |

## Request body

Content type: `application/json`, required.

| Field | Type | Required | Description |
|---|---|---|---|
| `auth_mode` | string, one of `autonomous`, `human_required`, `both` | no |  |
| `expires_at` | string or null (date-time) | no |  |
| `name` | string | yes |  |
| `policies` | array of object | no |  |
| `purpose` | string or null | no |  |

## Responses

### 201

Returns the newly created credential, including its secret. The secret is not returned by any other operation.

Body: `data`: Credential.

Fields of Credential:

| Field | Type | Required | Description |
|---|---|---|---|
| `auth_mode` | string, one of `autonomous`, `human_required`, `both` | yes |  |
| `created_at` | string (date-time) | yes |  |
| `created_by` | object | yes |  |
| `environment` | string, one of `production`, `sandbox` | yes |  |
| `expires_at` | string or null (date-time) | yes |  |
| `human` | object or null | yes | The administrator on whose behalf the current call is made, when the credential acts in human mode. null when the credential acts autonomously. |
| `id` | string | yes |  |
| `name` | string | yes |  |
| `object` | string, one of `credential` | yes |  |
| `policy` | object | yes |  |
| `purpose` | string or null | yes |  |
| `revision` | integer | yes |  |
| `revoked_at` | string or null (date-time) | yes |  |
| `revoked_by` | object or null | yes |  |
| `secret` | object or null | yes |  |
| `status` | string, one of `active`, `suspended`, `revoked` | yes |  |
| `updated_at` | string (date-time) | yes |  |

### 401

The credential is missing, malformed, expired, or revoked.

Body: Error.

### 403

The current credentials do not have the permission required by this operation.

Body: Error.

### 422

The request body or query parameters failed validation.

Body: ValidationFailed.

Full schema: https://cademi.dev/openapi/v3.json