s3.accesskey.create

Create an S3 access key.

An access key is the SigV4 credential pair a client signs S3 requests with. It belongs to a local or directory services account, and the S3 service runs that key’s requests as the account. It can never authenticate to the TrueNAS API. The access key id and the secret are generated unless supplied. The secret stays readable to administrators holding SHARING_S3_WRITE.

Type: object

Call parameters

Type: array
No Additional Items

Tuple Validation

Parameter 1: data

data

Type: object

Configuration for the new access key.

No Additional Properties

name Required

Name

Type: string

Human-readable name for the access key.

Must be at least 1 characters long

Must be at most 200 characters long

username Required

Username

Account the access key belongs to.

Any of

• Option 1
• Option 2

Type: string

Type: string

Must be at least 1 characters long

access_key

Access Key

Default: null

Access key id for the new key. Generated when omitted.

Any of

• Option 1
• Option 2

Type: string
Must match regular expression: ^[A-Z0-9]{16,128}$

Type: null

secret

Secret

Default: ""

Secret access key for the new key. Generated when omitted.

Any of

• Option 1
• Option 2

Type: string
Must match regular expression: ^[\x21-\x7E]+$

Must be at least 16 characters long

Must be at most 128 characters long

Type: null

enabled

Enabled

Type: boolean Default: true

Whether the access key may be used.

expires_at

Expires At

Default: null

Expiration timestamp for the access key or null for no expiration.

Any of

• Option 1
• Option 2

Type: stringFormat: date-time

Type: null

Return value

S3AccesskeyEntry

Type: object

The created access key, including its secret.

No Additional Properties

id Required

Id

Type: integer

Unique identifier for the access key.

name Required

Name

Type: string

Human-readable name for the access key.

Must be at least 1 characters long

Must be at most 200 characters long

username Required

Username

Account the access key belongs to, or null if that account no longer exists.

Any of

• Option 1
• Option 2
• Option 3

Type: string

Type: string

Must be at least 1 characters long

Type: null

user_identifier Required

User Identifier

Stored account linkage. A numeric user ID for local accounts or a SID for directory services accounts.

Any of

• Option 1
• Option 2

Type: integer

Type: string

local Required

Local

Type: boolean

Whether the access key belongs to a local user account rather than a directory services one.

access_key Required

Access Key

Type: string

The S3 access key id clients sign requests with.

Must match regular expression: ^[A-Z0-9]{16,128}$

secret Required

Secret

The S3 secret access key. Readable only by administrators holding SHARING_S3_WRITE; redacted for everyone else. null when the secret was lost to a configuration restore without the secret seed.

Any of

• Option 1
• Option 2

Type: string

Type: null

enabled Required

Enabled

Type: boolean

Whether the access key may be used. A disabled key is refused by the S3 service.

expires_at

Expires At

Default: null

Expiration timestamp for the access key or null for no expiration.

Any of

• Option 1
• Option 2

Type: stringFormat: date-time

Type: null

created_at Required

Created At

Type: stringFormat: date-time

Timestamp when the access key was created.

status Required

Status

Type: enum (of string)

Effective state of the access key. Only ENABLED keys are usable. DISABLED was set by an administrator, EXPIRED passed its expiration, USER_MISSING belongs to a directory account that no longer resolves (a deleted local account takes its keys with it), and SECRET_LOST lost its secret to a configuration restore without the secret seed and must be rotated.

Must be one of:

• "ENABLED"
• "DISABLED"
• "EXPIRED"
• "USER_MISSING"
• "SECRET_LOST"

Required roles: SHARING_S3_WRITE