Create an API key
Creates an API key and returns it as a JSON:API resource whose cleartext_api_key holds the secret, shown only this once. Requires a user access token, because an API key cannot create another API key. Only admins can create workspace keys.
Authorization
bearer User access token authentication. Every endpoint accepts it, and endpoints that act as a person accept only it. Send a WorkOS access token in the Authorization header as: Bearer <token>.
In: header
Path Parameters
The workspace slug — the {slug} segment of your Clarify workspace URL.
Query Parameters
When true, suppresses in-app and Slack notifications for this mutation.
Header Parameters
The API version for this request. Send 2026-10 to get the behavior documented here. Omit it to use your API key's version, which this header can raise but not lower.
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
curl -X POST "https://example.com/workspaces/string/api-keys" \ -H "clarify-version: 2026-10" \ -H "Content-Type: application/json" \ -d '{ "data": { "type": "api-key", "attributes": { "name": "Acme CRM sync", "scopes": [], "actor_type": "user" } } }'{ "data": { "type": "api-key", "id": "4a7c2e9f-6b1d-4e3a-8f5c-0d2b4e6a8c19", "attributes": { "_id": "4a7c2e9f-6b1d-4e3a-8f5c-0d2b4e6a8c19", "name": "Acme CRM sync", "key_prefix": "3f9a1c7e", "scopes": [], "actor": { "type": "user", "id": "7d4e2f9a-1b3c-4d5e-8f6a-9c0b2d4e6f81" }, "on_behalf_of": null, "hidden": false, "_created_by": "7d4e2f9a-1b3c-4d5e-8f6a-9c0b2d4e6f81", "expires_at": null, "api_version": "2026-01", "_created_at": "2026-01-15T09:30:00.000Z", "_updated_at": "2026-01-15T09:30:00.000Z", "last_used_at": null, "cleartext_api_key": "example00000000000000000000000000" } }}List record activities
Returns the activity feed for a record: one `activity_event` resource per change event, newest first. Each page covers at most 90 days back from the cursor, or from the record’s latest activity on the first page, and holds at most `page[limit]` events. A page can hold fewer events, even none, while `links.next` is set, so follow `links.next` until it is `null`. Events that share an `aggKey` and are adjacent can be shown as one activity.
Delete an API key
Revokes an API key so it stops authenticating requests. Requires a user access token. Admins can delete any key, and members only their own personal keys.