> ## Documentation Index > Fetch the complete documentation index at: https://docs.get-exo.com/llms.txt > Use this file to discover all available pages before exploring further. # Mint a sandbox (test-mode) API key > Mint a key bound to this org's sandbox partition. Mint a key bound to this organization's sandbox partition. The plaintext is returned exactly once and is unrecoverable afterwards: only its SHA-256 hash is stored. That is the same contract as `POST /v1/keys`, which this route reuses rather than reimplementing. Scopes are fixed at `read` and `write` and are not caller-selectable: a test key must never be able to mint keys, provision subjects or erase real data. The sandbox partition is provisioned on first mint, and the key is minted as `exo_sandbox_...` so it is recognisable on sight. Deliberately not replayable: a retried `Idempotency-Key` mints a fresh key instead of replaying the first response. Persisting a live credential in the replay store to save one key is the wrong trade. ## Authorization This route requires the `admin` scope. A missing or invalid credential returns 401 [`authentication_error`](/errors/authentication_error). A valid credential without the scope returns 403 [`permission_denied`](/errors/permission_denied), and the problem body names the exact scope required. ## Headers These are request conventions the contract does not declare as parameters, so they do not appear in the schema tables below. | Header | Applies | What it does | | ----------------- | -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `X-Exo-API-Key` | Required | Your Exo API key, `exo__`. `Authorization: Bearer exo_...` is accepted as an alternate. | | `X-Exo-Subject` | Not applicable | This route is not subject-scoped. | | `Idempotency-Key` | Not honoured | This route does not replay: a retry mints a fresh key rather than replaying the first response, because persisting a live credential in the replay store would undo the hash-only-at-rest design of the key store. | | `X-Request-Id` | Response | Returned on every response, including `204`s. Quote it in a support request. | ## Success responses | Status | Meaning | | ------ | -------------------------------- | | `201` | Key minted; apiKey is shown once | ## Errors | Status | Code | When | | ------ | ------------------------------------------------------ | -------------------------------------------------------------- | | `400` | [`invalid_request`](/errors/invalid_request) | Malformed request, for example an invalid cursor. | | `401` | [`authentication_error`](/errors/authentication_error) | Missing or invalid credentials. | | `403` | [`permission_denied`](/errors/permission_denied) | Missing scope, or an unprovisioned subject selector. | | `404` | [`not_found`](/errors/not_found) | The resource does not exist, or is not visible to this caller. | | `409` | [`conflict`](/errors/conflict) | A conflict with the current state of the resource. | | `422` | [`validation_error`](/errors/validation_error) | The request was understood but failed field validation. | | `429` | [`rate_limit_exceeded`](/errors/rate_limit_exceeded) | Rate limit exceeded. Retry after the Retry-After interval. | | `503` | [`service_degraded`](/errors/service_degraded) | A dependency is temporarily unavailable. Safe to retry. | Every error is an RFC 9457 `application/problem+json` body carrying a stable `code`, a `requestId`, and a `suggestedAction` where Exo has one. See [Errors](/platform/errors). ## Notes * **Sandbox keys are minted `exo_sandbox_...`** so they are recognisable on sight, and their scopes are fixed at `read` and `write`. * **A sandbox key cannot select out of its partition.** Sending `X-Exo-Subject` with one is 403 `permission_denied`. * **This route does not replay.** A retried `Idempotency-Key` mints a fresh key rather than persisting a live credential in the replay store. ## OpenAPI ````yaml openapi.json POST /v1/sandbox/keys openapi: 3.1.0 info: contact: name: Exo url: https://get-exo.com/ description: >- The Exo public developer API: ingest content, retrieve identity-conditioned context, and read the knowledge graph. Authenticate every request with an Exo API key, either as the X-Exo-API-Key header or as Authorization: Bearer exo_... . Errors follow RFC 9457 problem+json with a stable snake_case code on every body. title: Exo API version: 1.0.0 servers: - url: https://api.get-exo.com security: - ApiKeyHeader: [] - BearerAuth: [] tags: - name: retrieve x-group: Retrieval - name: search x-group: Search - name: ingest x-group: Ingestion - name: jobs x-group: Jobs - name: subjects x-group: Subjects - name: recall x-group: Recall - name: graph x-group: Graph - name: insights x-group: Contradictions and proposals - name: condition x-group: Condition - name: brain x-group: Brain - name: sessions x-group: Coding sessions - name: connectors x-group: Connectors - name: events x-group: Events and webhooks - name: meta x-group: Identity - name: keys x-group: Keys and sandbox - name: usage x-group: Usage - name: settings x-group: Settings - name: exports x-group: Exports - name: team x-group: Team - name: admin x-group: Account and purge paths: /v1/sandbox/keys: post: tags: - keys summary: Mint a sandbox (test-mode) API key description: >- Mint a key bound to this org's sandbox partition. Admin scope. The plaintext is returned exactly once and is unrecoverable afterwards (only its SHA-256 hash is stored) -- the same contract as the shipped ``POST /v1/keys``, whose ``issue_api_key`` / ``hash_key`` helpers this reuses verbatim rather than reimplementing. Scopes are fixed at ``read`` + ``write`` and are NOT caller-selectable: a test key must never be able to mint keys, provision subjects or erase real data. The org's sandbox partition is provisioned on first mint, and the key is minted as ``exo_sandbox_...`` so it is recognisable on sight. Deliberately NOT idempotency-replayable: this route never calls ``idempotency.complete``, so a retried ``Idempotency-Key`` mints a fresh key instead of replaying the first response. Persisting a plaintext credential in the replay store to save one key is the wrong trade. operationId: createSandboxKey requestBody: content: application/json: schema: anyOf: - $ref: '#/components/schemas/SandboxKeyMintRequest' - type: 'null' title: Body responses: '201': content: application/json: schema: $ref: '#/components/schemas/SandboxKeyMinted' description: Key minted; apiKey is shown once '400': content: application/problem+json: schema: $ref: '#/components/schemas/Problem' description: Malformed request, for example an invalid cursor. '401': content: application/problem+json: schema: $ref: '#/components/schemas/Problem' description: Missing or invalid credentials '403': content: application/problem+json: schema: $ref: '#/components/schemas/Problem' description: Missing scope or unprovisioned subject '404': content: application/problem+json: schema: $ref: '#/components/schemas/Problem' description: The requested resource does not exist. '409': content: application/problem+json: schema: $ref: '#/components/schemas/Problem' description: The reserved sandbox subject id is taken by a regular subject '422': content: application/problem+json: schema: $ref: '#/components/schemas/Problem' description: Malformed request '429': content: application/problem+json: schema: $ref: '#/components/schemas/Problem' description: Rate limit exceeded '503': content: application/problem+json: schema: $ref: '#/components/schemas/Problem' description: A dependency is unavailable components: schemas: SandboxKeyMintRequest: description: Body for POST /v1/sandbox/keys. Scopes are NOT caller-selectable. properties: label: anyOf: - maxLength: 200 type: string - type: 'null' description: Optional human label; defaults to 'Sandbox key'. title: Label title: SandboxKeyMintRequest type: object SandboxKeyMinted: description: A freshly minted sandbox key. ``apiKey`` is shown exactly once. properties: apiKey: title: Apikey type: string expiresAt: anyOf: - format: date-time type: string - type: 'null' description: When this test key stops authenticating. Mint another to continue. title: Expiresat id: title: Id type: string label: anyOf: - type: string - type: 'null' title: Label scopes: items: type: string title: Scopes type: array subject: title: Subject type: string required: - id - apiKey - scopes - subject title: SandboxKeyMinted type: object Problem: description: |- RFC 9457 problem+json envelope (spec D9), documented in OpenAPI. Invariant: ``code`` equals the tail of the ``type`` URI (``https://docs.get-exo.com/errors/``). properties: code: title: Code type: string detail: title: Detail type: string documentationUrl: anyOf: - type: string - type: 'null' title: Documentationurl errors: anyOf: - items: $ref: '#/components/schemas/FieldViolation' type: array - type: 'null' title: Errors requestId: default: '' title: Requestid type: string status: title: Status type: integer suggestedAction: anyOf: - type: string - type: 'null' title: Suggestedaction title: title: Title type: string type: title: Type type: string required: - type - title - status - detail - code title: Problem type: object FieldViolation: description: A single field-level violation inside a Problem ``errors[]`` list. properties: code: title: Code type: string field: title: Field type: string message: title: Message type: string pointer: title: Pointer type: string required: - pointer - field - code - message title: FieldViolation type: object securitySchemes: ApiKeyHeader: description: An Exo API key (exo_...) sent as the X-Exo-API-Key header. in: header name: X-Exo-API-Key type: apiKey BearerAuth: description: The same Exo API key (exo_...) sent as an Authorization bearer token. scheme: bearer type: http ````