# Create an API resource secret (/docs/apis/management/resources/CreateApiResourceSecret)

`POST /resources/api_resources/{api_id}/secrets`

Creates a new secret credential for the API resource, used to authenticate the resource during token introspection. Access to the API secret creation endpoint requires an active ScaleX subscription.

Base URL: `https://{tenant}.{region}.monocloud.com/api`, where `{tenant}`, `{region}` (one of us, eu, in) come from your tenant. Authentication: send your Management API key in the `X-API-KEY` header.

## Parameters

- `api_id` (path) (string, required) The unique identifier of the API resource.

## Request body

JSON, required. The request payload used to create an API resource secret.

- `description` (string) Description that explains the purpose of the secret.
- `expiration` (integer, date-time) Specifies the time at which the secret expires (in Epoch).
- `type` (string, default "shared_secret") Specifies the type of secret. One of: `shared_secret`, `x509_thumbprint`, `x509_name`, `x509_issuer_name`, `x509_certificate_base64`, `jwk`, `jwt_assertion_shared_secret`, `spiffe_id`, `jwt_svid_assertion`.
- `secret_value` (string) The secret value used to authenticate the client or API resource.

## Response body

`201`, JSON. The API resource secret was created successfully

Returns `Secret`.

- `id` (string, required) The unique identifier of the secret.
- `description` (string) Description that explains the purpose of the secret.
- `expiration` (integer, date-time) Specifies the time at which the secret expires (in Epoch).
- `type` (string, required) Specifies the type of secret. One of: `shared_secret`, `x509_thumbprint`, `x509_name`, `x509_issuer_name`, `x509_certificate_base64`, `jwk`, `jwt_assertion_shared_secret`, `spiffe_id`, `jwt_svid_assertion`.
- `creation_time` (integer, required, date-time) Specifies the creation time of the secret (in Epoch).
- `last_updated` (integer, required, date-time) Specifies the last update time of the secret (in Epoch).
- `secret_value` (string, required) The secret value used to authenticate the client or API resource.

## Errors

- `400` Bad Request
  - `type` (string, required) A URI reference that identifies the error type. When accessed, it may provide human-readable documentation.
  - `title` (string, required) A short, human-readable summary of the error.
  - `status` (integer, required, int32) The HTTP status code associated with this error response.
  - `trace_id` (string, required) A unique identifier for the request, used for tracing and diagnostics.
  - `detail` (string) A human-readable explanation specific to this occurrence of the error.
  - `instance` (string) A URI reference that identifies the specific occurrence of the error.
- `401` Unauthorized
- `402` Payment Required
  Same body as `400`.
- `403` Forbidden
- `404` Not Found
  Same body as `400`.
- `422` Unprocessable Entity
  - `type` (string, required) A URI reference that identifies the error type. When accessed, it may provide human-readable documentation.
  - `title` (string, required) A short, human-readable summary of the error.
  - `status` (integer, required, int32) The HTTP status code associated with this error response.
  - `trace_id` (string, required) A unique identifier for the request, used for tracing and diagnostics.
  - `detail` (string) A human-readable explanation specific to this occurrence of the error.
  - `instance` (string) A URI reference that identifies the specific occurrence of the error.
  - `errors` (Record<string, string[]>, required) A key-value map of validation errors, where each key represents a request field and the value contains one or more messages describing why the request could not be processed.

## Example (MonoCloud .NET SDK)

```csharp
using MonoCloud.Management;
using MonoCloud.Management.Models;
using MonoCloud.Management.Core.Base;

var apiClient = new MonoCloudManagementClient(new MonoCloudConfig("<your-domain>", "[[API-Key]]"));


var apiId = "n8TniSuy4WN9ROJYNwir6";

var requestBody = new CreateSecretRequest
  {
    Description = "Banking App Client Secret",
    Expiration = DateTime.Parse("1640975400"),
    Type = SecretTypes.SharedSecret,
    SecretValue = "d2980ac62d2e58d316728dba55ce",
  };


var result = await apiClient.Resources.CreateApiResourceSecretAsync(apiId, requestBody);
```

## Example (MonoCloud Javascript SDK)

```javascript
import { MonoCloudManagementClient } from '@monocloud/management';

const apiClient = MonoCloudManagementClient.init({ domain: '<your-domain>', apiKey: '[[API-Key]]' });

const apiId = 'n8TniSuy4WN9ROJYNwir6';

const requestBody = {
  description: 'Banking App Client Secret',
  expiration: '1640975400',
  type: 'shared_secret',
  secret_value: 'd2980ac62d2e58d316728dba55ce'
};

const result = apiClient.resources.createApiResourceSecret(apiId, requestBody);
```