# Create an API resource (/docs/apis/management/resources/CreateApiResource)

`POST /resources/api_resources`

Creates a new API resource that represents a protected backend or service and can be referenced by clients to request access tokens.

Base URL: `https://{tenant}.{region}.monocloud.com/api`, where `{tenant}`, `{region}` (one of us, eu, in) come from your tenant. Authentication: send your Management API key in the `X-API-KEY` header.

## Request body

JSON, required. The request payload used to create an API resource.

- `enabled` (boolean, default true) Indicates whether the resource is enabled.
- `display_name` (string) Human-readable display name for the resource.
- `description` (string) Description that explains the purpose of the resource.
- `audience` (string, required, uri) Audience value that will be included in issued access tokens for this API resource.
- `allow_multi_audience` (boolean, default false) Default value for whether access tokens issued for this API resource may carry additional audiences beyond this resource. Used when no matching API access policy provides an override. ScaleX subscription required to allow multi-audience tokens.
- `allow_user_info_access` (boolean, default false) Default value for whether access tokens issued for this API resource may include identity scopes, allowing them to be used with identity-related endpoints such as `UserInfo`. Used when no matching API access policy provides an override. ScaleX subscription required to allow UserInfo access.
- `access_token_type` (string, default "jwt") Default access token type for this API resource. Used when no matching API access policy provides an override. One of: `jwt`, `reference`.
- `access_token_lifetime` (integer, int32, default 3600) Default access token lifetime (in seconds) for this API resource. Used when no matching API access policy provides an override.
- `bind_tokens_to_session` (boolean, default false) Default value for whether access tokens issued for this API resource are bound to the user session, causing them to be revoked when the session ends. Used when no matching API access policy provides an override. ScaleX subscription required to use session binding.
- `include_jwt_id` (boolean, default true) Determines whether access tokens issued for this API resource include a unique token identifier (jti). Recommended for auditing, correlation, and replay-detection.
- `user_claims` (string[], default []) List of user claim types that will be embedded into access tokens issued for this API resource.
- `auto_generate_secret` (boolean, default false) Automatically generates a secure secret when the API resource is created. This secret is used by the resource to authenticate when performing token introspection. ScaleX subscription required to generate API secrets.

## Response body

`201`, JSON. The API resource was created successfully

Returns `ApiResource`.

- `id` (string, required) The unique identifier of the resource.
- `enabled` (boolean, required) Indicates whether the resource is enabled.
- `display_name` (string) Human-readable display name for the resource.
- `description` (string) Description that explains the purpose of the resource.
- `creation_time` (integer, required, date-time) Specifies the creation time of the resource (in Epoch).
- `last_updated` (integer, required, date-time) Specifies the last update time of the resource (in Epoch).
- `audience` (string, required) Audience value that will be included in issued access tokens for this API resource.
- `allow_multi_audience` (boolean, required) Default value for whether access tokens issued for this API resource may carry additional audiences beyond this resource. Used when no matching API access policy provides an override. ScaleX subscription required to allow multi-audience tokens.
- `allow_user_info_access` (boolean, required) Default value for whether access tokens issued for this API resource may include identity scopes, allowing them to be used with identity-related endpoints such as `UserInfo`. Used when no matching API access policy provides an override. ScaleX subscription required to allow UserInfo access.
- `access_token_type` (string, required) Default access token type for this API resource. Used when no matching API access policy provides an override. One of: `jwt`, `reference`.
- `access_token_lifetime` (integer, required, int32) Default access token lifetime (in seconds) for this API resource. Used when no matching API access policy provides an override.
- `bind_tokens_to_session` (boolean, required) Default value for whether access tokens issued for this API resource are bound to the user session, causing them to be revoked when the session ends. Used when no matching API access policy provides an override. ScaleX subscription required to use session binding.
- `include_jwt_id` (boolean, required) Determines whether access tokens issued for this API resource include a unique token identifier (jti). Recommended for auditing, correlation, and replay-detection.
- `user_claims` (string[], required) List of user claim types that will be embedded into access tokens issued for this API resource.

## Errors

- `400` Bad Request
  - `type` (string, required) A URI reference that identifies the error type. When accessed, it may provide human-readable documentation.
  - `title` (string, required) A short, human-readable summary of the error.
  - `status` (integer, required, int32) The HTTP status code associated with this error response.
  - `trace_id` (string, required) A unique identifier for the request, used for tracing and diagnostics.
  - `detail` (string) A human-readable explanation specific to this occurrence of the error.
  - `instance` (string) A URI reference that identifies the specific occurrence of the error.
- `401` Unauthorized
- `402` Payment Required
  Same body as `400`.
- `403` Forbidden
- `422` Unprocessable Entity
  - `type` (string, required) A URI reference that identifies the error type. When accessed, it may provide human-readable documentation.
  - `title` (string, required) A short, human-readable summary of the error.
  - `status` (integer, required, int32) The HTTP status code associated with this error response.
  - `trace_id` (string, required) A unique identifier for the request, used for tracing and diagnostics.
  - `detail` (string) A human-readable explanation specific to this occurrence of the error.
  - `instance` (string) A URI reference that identifies the specific occurrence of the error.
  - `errors` (Record<string, string[]>, required) A key-value map of validation errors, where each key represents a request field and the value contains one or more messages describing why the request could not be processed.

## Example (MonoCloud .NET SDK)

```csharp
using MonoCloud.Management;
using MonoCloud.Management.Models;
using MonoCloud.Management.Core.Base;

var apiClient = new MonoCloudManagementClient(new MonoCloudConfig("<your-domain>", "[[API-Key]]"));


var requestBody = new CreateApiResourceRequest
  {
    Enabled = true,
    DisplayName = "Designation",
    Description = "Current position in the employed organization",
    Audience = "https://example.com",
    AllowMultiAudience = false,
    AllowUserInfoAccess = true,
    AccessTokenType = AccessTokenTypes.Jwt,
    AccessTokenLifetime = 3600,
    BindTokensToSession = true,
    IncludeJwtId = true,
    UserClaims = new List<string>
    {
      "job_title",
    },
    AutoGenerateSecret = false,
  };


var result = await apiClient.Resources.CreateApiResourceAsync(requestBody);
```

## Example (MonoCloud Javascript SDK)

```javascript
import { MonoCloudManagementClient } from '@monocloud/management';

const apiClient = MonoCloudManagementClient.init({ domain: '<your-domain>', apiKey: '[[API-Key]]' });

const requestBody = {
  enabled: true,
  display_name: 'Designation',
  description: 'Current position in the employed organization',
  audience: 'https://example.com',
  allow_multi_audience: false,
  allow_user_info_access: true,
  access_token_type: 'jwt',
  access_token_lifetime: 3600,
  bind_tokens_to_session: true,
  include_jwt_id: true,
  user_claims: [
    'job_title'
  ],
  auto_generate_secret: false
};

const result = apiClient.resources.createApiResource(requestBody);
```