Create Credential Organization

Endpoint

POST /apiops/projects/{projectName}/credential-organizations/

Authentication

Requires a Personal API Access Token.

Header

Authorization: Bearer YOUR_TOKEN

Request

Headers

Header	Value	Required
Authorization	Bearer {token}	Yes
Content-Type	application/json	Yes

Path Parameters

Parameter	Type	Required	Description
projectName	string	Yes	Project name

Request Body

Full JSON Body Example

{
  "code": "team-alpha",
  "nameDefault": "Team Alpha",
  "nameSecondary": "Alpha Ekibi",
  "parentOrganizationCode": "root-org",
  "metadata": [
    {
      "key": "costCenter",
      "value": "CC-1001",
      "secret": false,
      "includeInJwt": true,
      "includeInTokenResponse": false,
      "jwtClaimName": null
    }
  ]
}

Request Body Fields

Field	Type	Required	Default	Description
code	string	Yes	-	Stable public identifier (unique within the project)
nameDefault	string	No	-	Primary display name
nameSecondary	string	No	-	Secondary display name
parentOrganizationCode	string	No	-	Parent organization code (must exist in the same project)
metadata	array[object]	No	[]	Custom metadata entries. See Metadata Object below
defaultLimitPlans	array[object]	No	-	Default limit plan per family for consumers created under the organization from then on: [{ "family": "REQUEST_RATE" | "AI_TOKEN_BUDGET", "planKey": "<published plan key>", "scope": "PROJECT" | "PLATFORM" }]. The plan must be published and belong to the project or the platform catalog. scope is optional: given, planKey must be an exact match in that catalog only; omitted, resolution falls back to the project catalog first, then the platform catalog. Omit the whole field to set none.

Metadata Object

Field	Type	Required	Default	Description
key	string	Yes	-	Metadata key
value	string	No	-	Metadata value. Secret entries are write-only on GET
secret	boolean	No	false	When true, the value is not returned on GET
includeInJwt	boolean	No	false	Include this entry in issued JWT access tokens
includeInTokenResponse	boolean	No	false	Include this entry in token endpoint JSON responses
jwtClaimName	string|null	No	null	Override JWT claim name; defaults to key when null

Response

Success Response (201 Created)

Returns the created CredentialOrganizationDTO. Secret metadata values are omitted from the response body.

{
  "code": "team-alpha",
  "nameDefault": "Team Alpha",
  "nameSecondary": "Alpha Ekibi",
  "parentOrganizationCode": "root-org",
  "metadata": [
    {
      "key": "costCenter",
      "value": "CC-1001",
      "secret": false,
      "includeInJwt": true,
      "includeInTokenResponse": false,
      "jwtClaimName": null
    }
  ]
}

Error Responses

Status	Condition
400	Blank code, parent organization not found, or invalid defaultLimitPlans entry (see Notes)
401	Invalid or missing token
409	An organization with the same code already exists in the project
500	Unexpected server error

cURL Example

curl -X POST \
  "https://demo.apinizer.com/apiops/projects/MyProject/credential-organizations/" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"code": "team-alpha", "nameDefault": "Team Alpha", "metadata": []}'

Notes and Warnings

• code is immutable. After creation, the organization is always addressed by code in path parameters.
• Metadata replaces the full list on update. On POST, an empty or omitted metadata array creates the organization with no metadata entries.
• Secret metadata is write-only. Values marked secret: true are never returned on GET; supply the value again on POST/PUT to set or change it.
• defaultLimitPlans applies to new consumers only. Existing consumers keep their assignments; use the Limit Plans bulk assignment for them. A planKey that is not published, belongs to another family, or is not visible to the project returns 400 (limit.orgDefault.planNotPublished, limit.orgDefault.planFamilyMismatch, limit.orgDefault.planNotFound). An unrecognized scope (anything other than PROJECT or PLATFORM) returns 400 (limit.orgDefault.scopeInvalid) — a typo does not silently fall back to searching both catalogs.

Permissions

User must have IDENTITY + MANAGE permission in the project.

Related Documentation

• Get Credential Organization
• Update Credential Organization
• Credential Organizations CRUD