Authenticate with an Organization Admin User API key, sent in the skyfire-api-key header. Keys belonging to Organization Admins are accepted; a MEMBER key, or any Agent API key, is rejected with 401.

The agent is resolved through the ownership chain organization → user → agent, all scoped to your own organization. A user or agent that does not exist, belongs to another organization, or is not owned by the given user returns 404. The agent must be active. An inactive agent also returns 404, including an agent group instance whose user has been unenrolled.

The raw key is returned only in this response and cannot be retrieved again. Store it securely on receipt. Afterwards the key is identified only by its id and lastFour.

The new key is active immediately. An agent can hold multiple active keys at once. Use the optional notes field to label keys for rotation tracking.

This is also how to replace a lost first key. The key returned when an agent is created, or when a user is enrolled in an agent group, is shown once; if it was not stored, create a new one here and deactivate the old one with Deactivate Agent API Key.