Skip to main content
POST
Create User
Mint a per-user API key scoped to a single index. Requires RBAC enabled on the service (CYBORGDB_SERVICE_ROOT_KEY set) and the request must be authenticated with the root key.
See Multi-Tenancy & RBAC for the full operator playbook.

Authentication

Required — root API key in the X-API-Key header:
The legacy single API key (CYBORGDB_API_KEY) is not accepted on this route; it returns 403.

Path Parameters

Request Body

For POST, the index key rides in the JSON body as index_key (alongside permissions). The sibling GET /v1/indexes/{index_name}/users and DELETE /v1/indexes/{index_name}/users/{user_id} endpoints have no request body, so they take the same key via the X-Index-Key header instead.

Response

The returned api_key is shown only in this response and is never persisted by the service. If you lose it, revoke the user (DELETE) and mint a new one.

Exceptions

  • 400: permissions is missing, empty, or contains values outside {"read", "write"}.
  • 401: Authentication failed (invalid root API key).
  • 403: RBAC is not enabled (CYBORGDB_SERVICE_ROOT_KEY unset), or the caller is not using the root key.
  • 404: Index not found.
  • 500: Internal server error.

Example Usage

Read-only user:
SDK-supplied index (legacy path):