Skip to content
UDX
2026-07-15
2026-07-15Latest
Esc
↑↓navigate↵open⌘Jpreview

Create an API Key

Persists a new API key from a caller-supplied public key. The public key must be RSA with a modulus between 2048 and 4096 bits, inclusive. The requested scopes must be a subset of the scopes the key’s user holds.

POST/api_keys
Authorization
Authorization
UDX-Access-KeyAPI key · headerrequired

Opaque API key ID.

UDX-Access-TimestampAPI key · headerrequired

Unix time in milliseconds, within 30 seconds of server time.

UDX-Access-SignatureAPI key · headerrequired

Standard-base64 RSA-PSS/SHA-256 signature with a 32-byte salt.

or
AuthorizationBearer token (JWT) · headerrequired

Bearer token for an active signed-in UDX user.

Header parameters
Header parameters
UDX-Versionstring

Dated API version (YYYY-MM-DD).

min length 10 · max length 10
UDX-Idempotency-Keystring

Optional client-generated key that makes a mutation safe to retry.

min length 1 · max length 255
Request body
requiredapplication/json
namestringrequired

A nickname for the new key.

min length 1 · max length 200
public_keystringrequired

PEM-encoded RSA public key.

min length 1 · max length 10000
scopesAPIKeyScope[]required

The permissions to grant this key.

min items 1 · max items 7
account_idstring | null

Restricts the key to a single account by its identifier. Omit (or null) to leave the key unrestricted.

Responses
201The created API key's metadata.
api_keyAPIKeyrequired

An API key's metadata.

Show properties
idEntityIdrequired

An exchange-assigned identifier. Treat it as an opaque, stable key with no internal structure.

min length 1
namestringrequired

The nickname given to this key at creation.

max length 200
scopesAPIKeyScope[]required

The permissions this key was granted at creation.

max items 7
account_idstring | null

The identifier of the single account this key is restricted to or null if it's usable against every account accessible to the caller.

created_atstring<date-time>required

When this key was created.

max length 40
400Request doesn't conform to this spec.
typestring<uri-reference>required

A stable URN identifying the kind of problem, for example urn:udx:problem:insufficient-permissions. Branch on it rather than on the localized detail. It is an identifier, not a URL to dereference.

max length 2048
titlestringrequired

A localized, human-readable summary of the error category. Stable for a given status code and resolved language — clients must not use it as a machine-readable discriminator.

max length 40
statusintegerrequired

The HTTP status code, repeated from the response itself.

detailstring

A localized, human-readable explanation specific to this occurrence. Clients must not parse it for machine-readable information.

max length 500
instancestring<uri-reference>

An identifier for this specific occurrence, so it can be correlated with server-side logs if you need to report it.

max length 100
401No valid credential was provided.
typestring<uri-reference>required

A stable URN identifying the kind of problem, for example urn:udx:problem:insufficient-permissions. Branch on it rather than on the localized detail. It is an identifier, not a URL to dereference.

max length 2048
titlestringrequired

A localized, human-readable summary of the error category. Stable for a given status code and resolved language — clients must not use it as a machine-readable discriminator.

max length 40
statusintegerrequired

The HTTP status code, repeated from the response itself.

detailstring

A localized, human-readable explanation specific to this occurrence. Clients must not parse it for machine-readable information.

max length 500
instancestring<uri-reference>

An identifier for this specific occurrence, so it can be correlated with server-side logs if you need to report it.

max length 100
403The caller cannot access account_id, the credential lacks the keys:manage scope, or a requested scope is not held by the key's user.
typestring<uri-reference>required

A stable URN identifying the kind of problem, for example urn:udx:problem:insufficient-permissions. Branch on it rather than on the localized detail. It is an identifier, not a URL to dereference.

max length 2048
titlestringrequired

A localized, human-readable summary of the error category. Stable for a given status code and resolved language — clients must not use it as a machine-readable discriminator.

max length 40
statusintegerrequired

The HTTP status code, repeated from the response itself.

detailstring

A localized, human-readable explanation specific to this occurrence. Clients must not parse it for machine-readable information.

max length 500
instancestring<uri-reference>

An identifier for this specific occurrence, so it can be correlated with server-side logs if you need to report it.

max length 100
409This idempotency key is still in use, or its request completed with a response too large to replay. The problem type tells the two apart.
typestring<uri-reference>required

A stable URN identifying the kind of problem, for example urn:udx:problem:insufficient-permissions. Branch on it rather than on the localized detail. It is an identifier, not a URL to dereference.

max length 2048
titlestringrequired

A localized, human-readable summary of the error category. Stable for a given status code and resolved language — clients must not use it as a machine-readable discriminator.

max length 40
statusintegerrequired

The HTTP status code, repeated from the response itself.

detailstring

A localized, human-readable explanation specific to this occurrence. Clients must not parse it for machine-readable information.

max length 500
instancestring<uri-reference>

An identifier for this specific occurrence, so it can be correlated with server-side logs if you need to report it.

max length 100
422This idempotency key belongs to a different request.
typestring<uri-reference>required

A stable URN identifying the kind of problem, for example urn:udx:problem:insufficient-permissions. Branch on it rather than on the localized detail. It is an identifier, not a URL to dereference.

max length 2048
titlestringrequired

A localized, human-readable summary of the error category. Stable for a given status code and resolved language — clients must not use it as a machine-readable discriminator.

max length 40
statusintegerrequired

The HTTP status code, repeated from the response itself.

detailstring

A localized, human-readable explanation specific to this occurrence. Clients must not parse it for machine-readable information.

max length 500
instancestring<uri-reference>

An identifier for this specific occurrence, so it can be correlated with server-side logs if you need to report it.

max length 100
429The member rate limit was exceeded.
typestring<uri-reference>required

A stable URN identifying the kind of problem, for example urn:udx:problem:insufficient-permissions. Branch on it rather than on the localized detail. It is an identifier, not a URL to dereference.

max length 2048
titlestringrequired

A localized, human-readable summary of the error category. Stable for a given status code and resolved language — clients must not use it as a machine-readable discriminator.

max length 40
statusintegerrequired

The HTTP status code, repeated from the response itself.

detailstring

A localized, human-readable explanation specific to this occurrence. Clients must not parse it for machine-readable information.

max length 500
instancestring<uri-reference>

An identifier for this specific occurrence, so it can be correlated with server-side logs if you need to report it.

max length 100
500Something went wrong on UDX's side.
typestring<uri-reference>required

A stable URN identifying the kind of problem, for example urn:udx:problem:insufficient-permissions. Branch on it rather than on the localized detail. It is an identifier, not a URL to dereference.

max length 2048
titlestringrequired

A localized, human-readable summary of the error category. Stable for a given status code and resolved language — clients must not use it as a machine-readable discriminator.

max length 40
statusintegerrequired

The HTTP status code, repeated from the response itself.

detailstring

A localized, human-readable explanation specific to this occurrence. Clients must not parse it for machine-readable information.

max length 500
instancestring<uri-reference>

An identifier for this specific occurrence, so it can be correlated with server-side logs if you need to report it.

max length 100
503Request admission is unavailable.
typestring<uri-reference>required

A stable URN identifying the kind of problem, for example urn:udx:problem:insufficient-permissions. Branch on it rather than on the localized detail. It is an identifier, not a URL to dereference.

max length 2048
titlestringrequired

A localized, human-readable summary of the error category. Stable for a given status code and resolved language — clients must not use it as a machine-readable discriminator.

max length 40
statusintegerrequired

The HTTP status code, repeated from the response itself.

detailstring

A localized, human-readable explanation specific to this occurrence. Clients must not parse it for machine-readable information.

max length 500
instancestring<uri-reference>

An identifier for this specific occurrence, so it can be correlated with server-side logs if you need to report it.

max length 100
Request
curl -X POST "https://api.underdogexchange.com/api_keys" \
  -H "UDX-Access-Key: API_KEY_ID" \
  -H "UDX-Access-Timestamp: UNIX_MILLISECONDS" \
  -H "UDX-Access-Signature: BASE64_SIGNATURE" \
  -H "Content-Type: application/json" \
  -d '{
  "name": "trading bot",
  "public_key": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAs73XRQ6kA8x4YhlozC6B\nF0+5iLfTU/MuYmvTCSaLH8/pgJBS+mggm5QeC0OkazwNMc1fzyx2n7OUFeN9Qm/M\nfyELPozTSSvPGebwUhsKyOZGKtO92HsejU075xnVsYWiYU+OA6DDxc5tR4mhMxS3\nDnHkwCQ1P2Z6SkaiYVQ2mMrGewT7TGlUYaZo+FI0svpJzMsJ5tNqjdh/9dsUC7WM\nATwMcoERX2Zb66ylk8dCw8rOoIE07/MTQfoH/z/++7rz+Jqt+KmnfKvSOOIr/WnE\nRLuBnd7OyKq7uCLGcWGq79FEa1ToWNcHAsLReElUU0shkqjRjaD1iKm83zh4XLWf\ngQIDAQAB\n-----END PUBLIC KEY-----",
  "scopes": [
    "read",
    "trade"
  ]
}'
Response
{
  "api_key": {
    "id": "3517456229634185646",
    "name": "trading bot",
    "scopes": [
      "read",
      "trade"
    ],
    "account_id": null,
    "created_at": "2026-06-01T12:00:00.000000Z"
  }
}