Skip to main content
POST
Create an API client
Your API client must have access to every organization in organizations, and API clients must be enabled for each of them. The clientSecret is returned only in this response and can’t be retrieved later, so store it securely right away. The new API client is ACTIVE immediately.

Path Parameters

realmId
string<uuid>
required

ID of your realm.

Format: UUID

Body

application/json
description
string
required

Display name of the API client.

Required string length: 1 - 255
Example:

"ERP Integration"

clientId
string
required

Readable identifier you choose for the API client, unique across Portão 3: letters, digits and + / = . _ -.

Required string length: 1 - 64
Pattern: ^[A-Za-z0-9+/=._-]*$
Example:

"prod-client-v2"

organizations
string<uuid>[]
required

Organizations the new API client can act on. Your API client must have access to each of them, and API clients must be enabled for each.

Format: UUID


Example: ["c4bd3f21-dfbd-44e8-8055-68ba15bed410"]

Minimum array length: 1

Response

Successful response

A newly created API client, including its secret.

id
string<uuid>
required

ID of the API client. Use it to deactivate the client.

Example:

"43230779-2cfb-4525-a40c-77fbf15e68f0"

clientId
string
required

Public identifier of the API client. Send it, with the client secret, to POST /auth/sign-in to get an access token.

Example:

"prod-client-v2"

description
string
required

Display name of the API client.

Example:

"ERP Integration"

realm
string<uuid>
required

ID of the realm the API client belongs to.

Example:

"f495ff0c-ab54-4f99-8e92-ca8682e4de9b"

organizations
object[]
required

Organizations the API client can act on.

status
enum<string>
required

ACTIVE clients can authenticate. DEACTIVATED clients can no longer authenticate; deactivation is permanent.

Available options:
ACTIVE,
DEACTIVATED
Example:

"ACTIVE"

createdAt
string<date-time>
required

When the API client was created.

Example:

"2026-10-13T18:43:50.746Z"

updatedAt
string<date-time>
required

When the API client last changed (for example, when it was deactivated).

Example:

"2026-10-13T18:43:50.746Z"

createdBy
string<uuid>
required

ID of the user or API client that created this API client.

Example:

"f1235202-71e0-49ef-a8ba-939b8d3ec945"

updatedBy
string<uuid>
required

ID of the user or API client that last changed this API client.

Example:

"f1235202-71e0-49ef-a8ba-939b8d3ec945"

clientSecret
string
required

Secret of the API client. It is returned only in this response and cannot be retrieved again, so store it securely right away.

Example:

"4+cHfGX6UIE&kmB8)vK$ils4R"