Skip to main content
POST
Python (SDK)

Authorizations

tql_api_key
string
header
required

Headers

Connect-Protocol-Version
enum<number>
default:1
required

Define the version of the Connect protocol

Available options:
1
Connect-Timeout-Ms
number

Define the timeout, in ms

Body

application/json
expirySeconds
integer | null
assumedRoles
string[]

Role IDs (UUIDs) to scope the new API key to. The service validates that each ID exists in the caller's org. Non-admin callers may only specify roles they already hold; assumed-role API key callers may only specify a subset of their current assumed roles.

inheritAllRoles
boolean | null

When true, the API key inherits all of the creating member's roles (no assumed-role scoping). Callers must set this explicitly when assumed_roles is empty; otherwise the request is rejected to prevent accidentally creating over-privileged keys.

name
string | null

Optional display name for the API key.

targetMemberId
string | null

Optional owner override for the new API key. If unset, the API key is created for the calling member. If set, the API key is created for this member ID (target principal): service-account targets require the caller to hold organization:write; human targets require api_access_key:delegate, and the key is bounded by the target member's roles with superadmin elevation always suppressed.

clientId
string | null

Optional client metadata stored on the API key as client_id. Prefer a JSON object string when using structured client attributes.

suppressSuperadmin
boolean

When true, requests authenticated with this key skip the @textql.com-email superadmin elevation branch. Only meaningful when paired with assumed_roles so a textql admin can preview a role's experience without superadmin permissions bleeding through.

Response

Success

apiKey
api_key · object
apiKeySecret
string
apiKeyHash
string
deprecated

Deprecated compatibility alias for api_key_secret. This field contains the same one-time bearer credential; it is not the hash stored at rest.