# POST /api/api-keys/for-user

Create and reveal an API key for a merchant user.

Mints an API key owned by the target merchant user and returns it with the revealed value.
A reseller or admin authorized over the user's merchant may call this. Every authorization or
existence failure returns an identical not-found response.

**Operation ID:** `POST_api_api-keys_for-user`

## Authorization

Requires: ApiKeyAuthorization.ApiKeys.CreateForUser, merchant scope.

Required permissions:
- `ApiKeyAuthorization.ApiKeys.CreateForUser`

## Parameters

| Name | In | Required | Type | Description |
| --- | --- | --- | --- | --- |
| suppressNulls | query | no | boolean | If true, omit properties with null values. |

## Request Body

**Content type:** `application/json`

Schema: `PhoeniXGateApiKeyAuthorizationApiKeysCreateApiKeyForMerchantUserDto`

**Content type:** `text/json`

Schema: `PhoeniXGateApiKeyAuthorizationApiKeysCreateApiKeyForMerchantUserDto`

**Content type:** `application/*+json`

Schema: `PhoeniXGateApiKeyAuthorizationApiKeysCreateApiKeyForMerchantUserDto`

## Responses

### 200

OK

**Content type:** `text/plain`

Schema: `PhoeniXGateApiKeyAuthorizationApiKeysApiKeyRevealedDto`

**Content type:** `application/json`

Schema: `PhoeniXGateApiKeyAuthorizationApiKeysApiKeyRevealedDto`

**Content type:** `text/json`

Schema: `PhoeniXGateApiKeyAuthorizationApiKeysApiKeyRevealedDto`

### 403

Forbidden

**Content type:** `text/plain`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

**Content type:** `application/json`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

**Content type:** `text/json`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

### 401

Unauthorized

**Content type:** `text/plain`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

**Content type:** `application/json`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

**Content type:** `text/json`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

### 400

Bad Request

**Content type:** `text/plain`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

**Content type:** `application/json`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

**Content type:** `text/json`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

### 404

Not Found

**Content type:** `text/plain`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

**Content type:** `application/json`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

**Content type:** `text/json`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

### 501

Not Implemented

**Content type:** `text/plain`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

**Content type:** `application/json`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

**Content type:** `text/json`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

### 500

Internal Server Error

**Content type:** `text/plain`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

**Content type:** `application/json`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

**Content type:** `text/json`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

### default

The request failed. The body carries the standard error envelope: a machine-readable `error.code`, a human-readable `error.message`, and `error.validationErrors` when the failure was a validation rejection. See the error-code reference in this document's description for the values `error.code` can take.

**Content type:** `application/json`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

## See also

- [All documentation](https://docs.winkpg.io/llms.txt): the machine-readable index of every public page on this site.