Skip to content
API Enriched

Create API Credentials.

POST
/api/web/namespaces/{namespace}/api_credentials
curl --request POST \
  --url https://example-corp.console.ves.volterra.io/api/v1/api/production/us-east-1/namespaces/default/api/web/namespaces/example/api_credentials \
  --header 'Authorization: <Authorization>' \
  --header 'Content-Type: application/json' \
  --data '{ "expiration_days": 1, "name": "example", "namespace": "example", "spec": { "password": "example", "type": "API_CERTIFICATE", "virtual_k8s_name": "example", "virtual_k8s_namespace": "example" } }'

User can request 3 types of credential for themselves. API_TOKEN, API_CERTIFICATE and KUBE_CONFIG.

An API_TOKEN is an easy to use secret that can be send part of HTTP request header Authorization: APIToken in the create request expiry can be set additionally. F5XC also supports renew and revoke of API_TOKENs. An API_CERTIFICATE is a password protected P12 certificate bundle document and can be used as client certificate. When sending create request, user can request with an expiry and password. F5XC Identity Authority (IA) mints new certificate with required credentials and is shared in the response as API Certificate. A virtual K8s kubeconfig can be generate with type KUBE_CONFIG. Create request can specify cluster, namespace and expiry with embedded user access with client certificate.

Request can specify name, expiry and type of credential required. Since this credential inherits the creator’s RBAC service will determine the user from request context.

Examples of this operation.

Authorizations

Section titled “Authorizations”

Parameters

Section titled “Parameters”

Path Parameters

Section titled “Path Parameters”
namespace
required
string

Namespace Value of namespace is always “system”.

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json
Create Request

CreateRequest is the request format for generating API credential.

object
expiration_days
Expiry in days

Qty of days of service credential expiration.

integer format: int64
name
Name

Name of API credential record. It will be saved in metadata.

string
>= 6 characters <= 1024 characters
namespace
Namespace

Value of namespace is always “system”.

string
>= 6 characters <= 1024 characters
spec
object
password
Password for API certificate

Password is used for generating an API certificate P12 bundle user can use to protect access to it. This password will not be saved/persisted anywhere in the system. Applicable for credential type API_CERTIFICATE Users have to use this password when they use the certificate, e.g. In curl or while adding to key chain. Required: YES.

string
<= 1024 characters
type
string
default: API_CERTIFICATE
Allowed values: API_CERTIFICATE KUBE_CONFIG API_TOKEN SERVICE_API_TOKEN SERVICE_API_CERTIFICATE SERVICE_KUBE_CONFIG SITE_GLOBAL_KUBE_CONFIG SCIM_API_TOKEN SERVICE_SITE_GLOBAL_KUBE_CONFIG
virtual_k8s_name
virtual k8s cluster name

Name of virtual K8s cluster. Applicable for KUBE_CONFIG.

string
<= 1024 characters
virtual_k8s_namespace
Virtual K8s namespace

Namespace of virtual K8s cluster. Applicable for KUBE_CONFIG.

string
<= 1024 characters

Responses

Section titled “Responses”

200

Section titled “200”

A successful response.

Media typeapplication/json
Create response

CreateResponse is the response format for the credential’s create request.

object
active

Indicates if the resource is active

boolean format: boolean
data
Credentials

Data is the response format based on the API credential type. In case of API_CERTIFICATES, the response is the base64 encoded value of certificate in PKCS12 format. In case of KUBE_CONFIG, the response is the base64 encoded value of the K8s kubeconfig file with contents as requested - cluster,namespace and base64 encoded certificate, key and CA.

string
<= 1024 characters
expiration_timestamp

Configuration parameter for expiration timestamp

string format: date-time
<= 1024 characters
name

Human-readable name for the resource

string
>= 6 characters <= 1024 characters
Examplegenerated
{
  "active": true,
  "data": "example",
  "expiration_timestamp": "2026-04-15T12:00:00Z",
  "name": "example"
}

401

Section titled “401”

Returned when operation is not authorized.

Media typeapplication/json
string format: string
Examplegenerated
example

403

Section titled “403”

Returned when there is no permission to access resource.

Media typeapplication/json
string format: string
Examplegenerated
example

404

Section titled “404”

Returned when resource is not found.

Media typeapplication/json
string format: string
Examplegenerated
example

409

Section titled “409”

Returned when operation on resource is conflicting with current value.

Media typeapplication/json
string format: string
Examplegenerated
example

429

Section titled “429”

Returned when operation has been rejected as it is happening too frequently.

Media typeapplication/json
string format: string
Examplegenerated
example

500

Section titled “500”

Returned when server encountered an error in processing API.

Media typeapplication/json
string format: string
Examplegenerated
example

503

Section titled “503”

Returned when service is unavailable temporarily.

Media typeapplication/json
string format: string
Examplegenerated
example

504

Section titled “504”

Returned when server timed out processing request.

Media typeapplication/json
string format: string
Examplegenerated
example