Mint a scoped API key.
You supply the secret in key; the server stores only its hash and never
returns it again. Generate it with a cryptographically secure random source.
permissions defaults to ["events:add"] — an ingest-only key.
Authorizations
A scoped AgentEye API key. Mint one in the dashboard under Settings → API keys, or with POST /v1/keys. Each endpoint names the permission it requires; a key without it gets 403 and a required_permission field naming what was missing.
Body
When the key stops working, RFC 3339. Omit for a key that never expires, which is every key minted through the normal flow.
Only ever restrictive: an expiring key is strictly weaker than a
permanent one, so accepting this from any keys:create holder grants
nothing. Enforcement is in the auth lookup, with up to 60s of cache lag
(see the migration and crate::auth).
Defaults to ["events:add"] if omitted.
Response
Key created.