> ## Documentation Index
> Fetch the complete documentation index at: https://docs.reply.io/llms.txt
> Use this file to discover all available pages before exploring further.
# Create an API key
>
**Coming soon.** This endpoint will be available by mid November 2026.
_Requires the `api-keys:write` scope (or a broader one that includes it)._
Create a key as **Settings → API Key** does. `key` appears in this response only.
An API key needs `api-keys:write`, which `*:*` does not include, and may create only keys no wider than itself; only an organization key may create an organization key. A session token of an application other than Reply's own is refused from creating or widening keys. This bounds registered applications; it is not a credential check, since a public application's identifier is not a secret.
`type` defaults to `user`; `team` needs the team owner, `organization` the right to manage organization keys. `scopes` takes exact values; wildcards are granted only in Settings. An API key with an expiry must set `expiresAt`, no later than its own. An owner holds at most 25 unexpired keys of a type.
## OpenAPI
````yaml /api-reference/bundled.yaml post /v3/api-keys
openapi: 3.1.0
info:
version: 3.0.0
title: Reply API
description: API for managing email sequences, contacts, and automation workflows
servers:
- url: https://api.reply.io
security:
- bearerAuth: []
tags:
- name: Contacts
description: Manage individual contacts
- name: Contact Lists
description: Manage contact lists and contact membership
- name: Accounts
description: Manage accounts (companies/organizations)
- name: Account Lists
description: Manage account lists and account membership
- name: Custom Fields
description: Manage custom contact fields
- name: Prompt Actions
description: Save reusable AI prompts and run them on contacts to fill custom fields
- name: Contact Blacklist Rules
description: Manage blacklist rules for domains, emails, and email exceptions
- name: Live Data
description: >-
Find new contacts via Live Data searches and read typeahead values for the
Live Data / Autopilot filter sidebar
- name: Contact Enrichment
description: >-
Enrich contacts with emails, phone numbers, LinkedIn data, and AI-filled
custom fields
- name: Email Validations
description: Estimate and schedule asynchronous email validation jobs
- name: AI SDR Web Search
description: Find contacts via AI-driven web search and review past searches
- name: Sequences
description: Manage email automation sequences
- name: Sequence Steps
description: Manage individual steps in sequences
- name: Sequence Contacts
description: Manage contacts within sequences
- name: Sequence Folders
description: Organize sequences into folders
- name: Email Accounts
description: Manage email accounts used for sending and receiving
- name: Sequence Email Accounts
description: Manage email accounts linked to sequences
- name: LinkedIn Accounts
description: Manage LinkedIn accounts for outreach
- name: Sequence LinkedIn Accounts
description: Manage LinkedIn accounts linked to sequences
- name: Sequence Templates
description: Manage sequence templates
- name: Email Templates
description: Manage email templates and template folders
- name: Voices
description: Manage cloned voices used for AI voice message steps
- name: Schedules
description: Manage email send schedules and timing
- name: Holiday Calendars
description: Manage holiday calendars for scheduling
- name: Inbox
description: >-
Manage inbox threads — list/filter, read state, replies, category
assignment, and meeting-intent flagging
- name: Inbox Categories
description: Manage per-team inbox thread categories and assign threads to them
- name: Direct Outreach
description: >-
Send one-off outreach directly to a contact outside of any sequence —
direct emails and LinkedIn connection requests, messages, InMails, and
voice messages
- name: Tasks
description: Manage tasks and to-do items
- name: Reports
description: >-
Generate and access performance reports across email, calls, tasks,
LinkedIn, and team performance
- name: AI SDR Sequences
description: >-
Manage AI SDR sequences and their AI SDR-specific settings — create, read
settings, partial update, autopilot enable/disable/force-start, approval
mode, sequence structure, and playbook/knowledge-base connections
- name: AI SDR Sequence Structures
description: >-
Browse the sequence structures — reusable outlines of AI SDR sequence
steps — that can be applied to AI SDR sequences
- name: AI SDR Strategist
description: Trigger AI Strategist runs
- name: AI SDR Playbooks
description: >-
Manage AI SDR playbooks — tone, voice, and style guides applied during
personalized message generation
- name: AI SDR Knowledge Bases
description: >-
Manage AI SDR knowledge bases — collections of documents, links, reply
handlers, and reengagement cards that inform the agent's responses
- name: AI SDR Offers
description: >-
Manage AI SDR offers — bundles of company-context inputs (ICP, pain
points, value propositions, etc.) used to personalize outreach
- name: AI SDR Pending Approvals
description: >-
Review, send, regenerate, and provide feedback on AI-generated messages
awaiting human approval
- name: AI SDR Sequence Preview
description: >-
Read and regenerate per-contact previews of the messages a sequence will
send, and provide feedback on preview messages
- name: AI SDR Insights
description: Read AI SDR insights for sequence contacts
- name: AI SDR Intent Signals
description: >-
Read Reply industry IDs and technology slugs used in AI SDR intent-signal
configuration (typeahead)
- name: AI Prompts
description: >-
Manage the AI prompts used to configure sequence steps, and preview the
output a prompt produces
- name: AI SDR Learnings
description: >-
Manage the standing rules that shape how the AI writes — list, read,
create, partially update and delete AI learnings
- name: Registration
description: Register the contact that domain purchases are filed under
- name: Domains
description: Find domains available to buy for outreach
- name: Purchased Domains
description: >-
List the domains your team bought, with their subscription, setup and
renewal state, and renew them
- name: Pre-warmed Domains
description: >-
Find pre-warmed domains on sale, with mailboxes that are already warming,
and list the ones your team bought
- name: Mailboxes
description: >-
Add mailboxes to domains your team already bought, priced before you
order, and reconnect them
- name: User Account
description: Account information and authentication verification
- name: API Keys
description: Create, list, edit and delete API keys, as the Settings page does
- name: Teams
description: Add existing users of your organization to its teams
- name: Settings
description: Manage team and user settings
- name: Billing
description: Subscription details and monthly active contacts usage
- name: Rate Limits
description: Your API rate limits, your current usage and the packages that raise them
- name: Support Requests
description: Raise and follow support requests with Reply's support team
- name: Webhooks
description: Manage webhook subscriptions and inspect delivery history
- name: Background Jobs
description: >-
Track and cancel asynchronous background operations (e.g., email
validation)
- name: Attachments
description: >-
Upload file attachments used across email templates, sequence steps, and
direct emails
paths:
/v3/api-keys:
post:
tags:
- API Keys
summary: Create an API key
description: >-
**Coming soon.** This endpoint will be available by mid November 2026.
_Requires the `api-keys:write` scope (or a broader one that
includes it)._
Create a key as **Settings → API Key** does. `key` appears in this
response only.
An API key needs `api-keys:write`, which `*:*` does not include, and may
create only keys no wider than itself; only an organization key may
create an organization key. A session token of an application other than
Reply's own is refused from creating or widening keys. This bounds
registered applications; it is not a credential check, since a public
application's identifier is not a secret.
`type` defaults to `user`; `team` needs the team owner, `organization`
the right to manage organization keys. `scopes` takes exact values;
wildcards are granted only in Settings. An API key with an expiry must
set `expiresAt`, no later than its own. An owner holds at most 25
unexpired keys of a type.
operationId: CreateApiKey
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
type:
default: user
type: string
enum:
- user
- team
- organization
description: Who the key belongs to.
name:
type: string
maxLength: 100
description: A name to tell the key apart.
scopes:
type: array
description: Exact scope values, such as `contacts:read`.
items:
type: string
expiresAt:
type: string
format: date-time
nullable: true
description: >-
When the key stops working, which cannot change later. It
must be in the future; leave it out and the key never
expires. An API key that has an expiry must set this, no
later than its own.
example:
type: user
name: Outbound agent
scopes:
- contacts:read
- inbox:operate
expiresAt: '2026-12-20T09:00:00Z'
responses:
'201':
description: The key was created.
headers:
Cache-Control:
description: Always `no-store`.
schema:
type: string
content:
application/json:
schema:
allOf:
- allOf:
- type: object
required:
- id
- type
- hint
- createdAt
properties:
id:
type: integer
description: The key's id.
type:
type: string
enum:
- user
- team
- organization
description: Who the key belongs to.
name:
type: string
nullable: true
description: The key's name.
hint:
type: string
description: >-
The start and end of the key, as Settings shows
it.
createdAt:
type: string
format: date-time
description: When the key was created.
expiresAt:
type: string
format: date-time
nullable: true
description: >-
When the key stops working, or `null` if it never
does.
- type: object
required:
- scopes
properties:
scopes:
type: array
description: >-
The scopes as stored, which may include wildcards
set in Settings.
items:
type: string
- type: object
required:
- key
properties:
key:
type: string
description: The API key. It appears in this response only.
example:
id: 8120
type: user
name: Outbound agent
hint: usk_Zm9y...1rZXk
scopes:
- contacts:read
- inbox:operate
createdAt: '2026-11-20T09:00:00Z'
expiresAt: '2026-12-20T09:00:00Z'
key: usk_Zm9yLWRvY3Mtb25seS1ub3QtYS1rZXk
'400':
description: >-
The body failed validation, or a value is not an exact scope. An API
key with an expiry also gets this for an `expiresAt` that is missing
or later than its own.
content:
application/json:
schema:
oneOf:
- allOf:
- allOf:
- type: object
title: Problem Details
description: >-
Bare RFC 9457 problem-details envelope. Returned
by middleware-level errors
that don't carry domain context: 401 Unauthorized
(auth middleware),
429 Too Many Requests (rate-limit middleware), and
route-level 404 / 405 /
415 (framework middleware).
Business and validation responses extend this
envelope and add additional
fields — see `business-problem.model.yaml` (adds
`code` slug) and
`validation-problem.model.yaml` (adds `errors[]`
array).
properties:
title:
type: string
description: Short, human-readable summary of the problem.
status:
type: integer
description: HTTP status code.
minimum: 100
maximum: 599
detail:
type: string
description: >-
Human-readable explanation specific to this
occurrence.
- type: object
properties:
errors:
type: array
description: >-
List of field-level validation errors. Always
non-empty when this
envelope is returned. Each entry pins a single
offending field
via JSON Pointer plus a sanitized detail
string.
items:
type: object
title: Validation Error
description: A single field-level validation error.
properties:
pointer:
type: string
description: >-
JSON Pointer (RFC 6901) to the offending
field — e.g.
`/steps/0/subject`.
* An empty string (`""`) means the error
applies to the whole
request body (e.g. body is missing or unparseable).
* For route or query parameter failures
the pointer is the parameter
name (e.g. `id`, `top`).
example: /steps/0/subject
detail:
type: string
description: >-
Sanitized, human-readable explanation of
this field's error. One of a
small set of templates — `"Field is
required."`, `"Value has an
invalid type."`, `"Value has an invalid
format."`, `"Request body is
not valid JSON."`, `"The request body is
required and cannot be
empty."` — or a FluentValidator message
on body endpoints.
example: Field is required.
title: Validation Problem
description: >-
Input-validation error response at 400. Returned when
the request body
fails binding, FluentValidator rules, or when
route/query parameter
attribute validation (`[Range]`, `[Required]`) fails.
Route, query, and
body errors are combined into a single `errors[]`
array — clients should
not assume one error per request.
- example:
title: Validation failed
status: 400
detail: The request body contains validation errors.
errors:
- pointer: /name
detail: Field is required.
- allOf:
- allOf:
- type: object
title: Problem Details
description: >-
Bare RFC 9457 problem-details envelope. Returned
by middleware-level errors
that don't carry domain context: 401 Unauthorized
(auth middleware),
429 Too Many Requests (rate-limit middleware), and
route-level 404 / 405 /
415 (framework middleware).
Business and validation responses extend this
envelope and add additional
fields — see `business-problem.model.yaml` (adds
`code` slug) and
`validation-problem.model.yaml` (adds `errors[]`
array).
properties:
title:
type: string
description: Short, human-readable summary of the problem.
status:
type: integer
description: HTTP status code.
minimum: 100
maximum: 599
detail:
type: string
description: >-
Human-readable explanation specific to this
occurrence.
- type: object
properties:
code:
type: string
description: >-
Stable, machine-readable error slug in the
form
`"."`.
* `resource` is the camelCased domain — e.g.
`sequence`,
`contact`, `inboxThread`, `blacklistDomainRule`.
* `variant` is the camelCased specific failure
mode — e.g.
`notFound`, `forbidden`, `duplicateName`, `globalRuleReadOnly`.
Use `code` for programmatic error handling;
use `detail` for
user-facing messages. Slugs are stable across
server-side enum
reorderings and never change meaning under a
given resource.
pattern: ^[a-z][a-zA-Z0-9]*(\.[a-z][a-zA-Z0-9]*)+$
example: sequence.notFound
title: Business Problem
description: >-
Domain error response carrying a stable, namespaced
error slug.
Emitted for most 4xx responses (business 400, 403,
404, 409, …) and
for 503 when a downstream dependency is unavailable.
- example:
title: Bad Request
status: 400
detail: Pagination parameters are invalid.
code: sequence.invalidPagination
examples:
invalid_expiry:
summary: The expiry is in the past
value:
title: Validation failed
status: 400
detail: The request body contains validation errors.
errors:
- pointer: /expiresAt
detail: >-
ExpiresAt must be in the future, or null to never
expire.
expiry_past_caller:
summary: The key would outlive the API key creating it
value:
title: Validation failed
status: 400
detail: The request body contains validation errors.
errors:
- pointer: /expiresAt
detail: >-
A key created by an expiring key must expire no later
than it does.
invalid_scope:
summary: A value is not an exact scope
value:
title: Bad Request
status: 400
detail: '''contacts:*'' is not a scope this route can grant.'
code: apiKey.invalidScope
'401':
description: >-
Unauthorized. The response body is empty; check the
`WWW-Authenticate` header for the expected scheme.
content:
application/problem+json:
schema:
allOf:
- type: object
title: Problem Details
description: >-
Bare RFC 9457 problem-details envelope. Returned by
middleware-level errors
that don't carry domain context: 401 Unauthorized (auth
middleware),
429 Too Many Requests (rate-limit middleware), and
route-level 404 / 405 /
415 (framework middleware).
Business and validation responses extend this envelope and
add additional
fields — see `business-problem.model.yaml` (adds `code`
slug) and
`validation-problem.model.yaml` (adds `errors[]` array).
properties:
title:
type: string
description: Short, human-readable summary of the problem.
status:
type: integer
description: HTTP status code.
minimum: 100
maximum: 599
detail:
type: string
description: >-
Human-readable explanation specific to this
occurrence.
- example:
title: Unauthorized
status: 401
detail: Authentication credentials are missing or invalid.
'403':
description: >-
Refused. `code` says why:
- `apiKey.forbidden`: the user may not manage this type of key.
- `apiKey.scopeNotHeld`: the calling API key does not hold the scope
`detail` names.
- `apiKey.typeNotHeld`: this API key acts as one user, so it cannot
create or change an organization key.
- `apiKey.clientNotAllowed`: this application cannot create API keys
or change their scopes.
An API key without `api-keys:write` is refused before these: `error`
is `insufficient_scope` and `required_scope` names the scope.
content:
application/json:
schema:
allOf:
- allOf:
- type: object
title: Problem Details
description: >-
Bare RFC 9457 problem-details envelope. Returned by
middleware-level errors
that don't carry domain context: 401 Unauthorized
(auth middleware),
429 Too Many Requests (rate-limit middleware), and
route-level 404 / 405 /
415 (framework middleware).
Business and validation responses extend this envelope
and add additional
fields — see `business-problem.model.yaml` (adds
`code` slug) and
`validation-problem.model.yaml` (adds `errors[]`
array).
properties:
title:
type: string
description: Short, human-readable summary of the problem.
status:
type: integer
description: HTTP status code.
minimum: 100
maximum: 599
detail:
type: string
description: >-
Human-readable explanation specific to this
occurrence.
- type: object
properties:
code:
type: string
description: >-
Stable, machine-readable error slug in the form
`"."`.
* `resource` is the camelCased domain — e.g.
`sequence`,
`contact`, `inboxThread`, `blacklistDomainRule`.
* `variant` is the camelCased specific failure
mode — e.g.
`notFound`, `forbidden`, `duplicateName`, `globalRuleReadOnly`.
Use `code` for programmatic error handling; use
`detail` for
user-facing messages. Slugs are stable across
server-side enum
reorderings and never change meaning under a given
resource.
pattern: ^[a-z][a-zA-Z0-9]*(\.[a-z][a-zA-Z0-9]*)+$
example: sequence.notFound
title: Business Problem
description: >-
Domain error response carrying a stable, namespaced error
slug.
Emitted for most 4xx responses (business 400, 403, 404,
409, …) and
for 503 when a downstream dependency is unavailable.
- example:
title: Forbidden
status: 403
detail: You do not have permission to access this resource.
code: sequence.forbidden
example:
title: Forbidden
status: 403
detail: >-
This API key does not hold 'inbox:read', so it cannot leave a
key with it.
code: apiKey.scopeNotHeld
application/problem+json:
schema:
type: object
description: The API key does not hold the scope this route requires.
required:
- error
- message
- required_scope
properties:
error:
type: string
description: Always `insufficient_scope`.
message:
type: string
description: Names the scope the route requires.
required_scope:
type: string
description: The scope the route requires.
example:
error: insufficient_scope
message: This endpoint requires scope 'api-keys:write'.
required_scope: api-keys:write
'409':
description: >-
The owner already holds the most unexpired keys of this type. Delete
one, or let one expire, to create another.
content:
application/json:
schema:
allOf:
- allOf:
- type: object
title: Problem Details
description: >-
Bare RFC 9457 problem-details envelope. Returned by
middleware-level errors
that don't carry domain context: 401 Unauthorized
(auth middleware),
429 Too Many Requests (rate-limit middleware), and
route-level 404 / 405 /
415 (framework middleware).
Business and validation responses extend this envelope
and add additional
fields — see `business-problem.model.yaml` (adds
`code` slug) and
`validation-problem.model.yaml` (adds `errors[]`
array).
properties:
title:
type: string
description: Short, human-readable summary of the problem.
status:
type: integer
description: HTTP status code.
minimum: 100
maximum: 599
detail:
type: string
description: >-
Human-readable explanation specific to this
occurrence.
- type: object
properties:
code:
type: string
description: >-
Stable, machine-readable error slug in the form
`"."`.
* `resource` is the camelCased domain — e.g.
`sequence`,
`contact`, `inboxThread`, `blacklistDomainRule`.
* `variant` is the camelCased specific failure
mode — e.g.
`notFound`, `forbidden`, `duplicateName`, `globalRuleReadOnly`.
Use `code` for programmatic error handling; use
`detail` for
user-facing messages. Slugs are stable across
server-side enum
reorderings and never change meaning under a given
resource.
pattern: ^[a-z][a-zA-Z0-9]*(\.[a-z][a-zA-Z0-9]*)+$
example: sequence.notFound
title: Business Problem
description: >-
Domain error response carrying a stable, namespaced error
slug.
Emitted for most 4xx responses (business 400, 403, 404,
409, …) and
for 503 when a downstream dependency is unavailable.
- example:
title: Conflict
status: 409
detail: A resource with this name already exists.
code: sequence.duplicateName
example:
title: Conflict
status: 409
detail: >-
The limit of 25 active API keys is reached. Delete a key to
create another.
code: apiKey.limitReached
'429':
description: Too Many Requests
headers:
Retry-After:
description: Seconds to wait before retrying
schema:
type: integer
minimum: 1
content:
application/problem+json:
schema:
allOf:
- type: object
title: Problem Details
description: >-
Bare RFC 9457 problem-details envelope. Returned by
middleware-level errors
that don't carry domain context: 401 Unauthorized (auth
middleware),
429 Too Many Requests (rate-limit middleware), and
route-level 404 / 405 /
415 (framework middleware).
Business and validation responses extend this envelope and
add additional
fields — see `business-problem.model.yaml` (adds `code`
slug) and
`validation-problem.model.yaml` (adds `errors[]` array).
properties:
title:
type: string
description: Short, human-readable summary of the problem.
status:
type: integer
description: HTTP status code.
minimum: 100
maximum: 599
detail:
type: string
description: >-
Human-readable explanation specific to this
occurrence.
example:
title: Too Many Requests
status: 429
detail: API calls quota exceeded! maximum admitted 100 per 1m.
components:
securitySchemes:
bearerAuth:
type: http
scheme: bearer
description: >-
Authenticate every request with a Bearer token. Pass your Reply API key
in the
`Authorization` header:
```
Authorization: Bearer
```
Get your API key from the Reply dashboard: **Settings → API Key**.
````
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.