Apier

Redeem an owner-issued key-issuance token (keyless)

redeem_issuance_token

Convert an owner-issued key-issuance token into your own API key — the headless onboarding step for an agent that holds no credential yet. Keyless: the one-time token IS the credential. Minting and revocation are dashboard-only, so an agent can never self-issue authority. Redemption is strictly SINGLE-USE and atomic: on success (201) the token is consumed and the result carries {id, name, scopes, created_at, plaintext_key} — returned EXACTLY ONCE; store it immediately. Failure modes: an expired / used / revoked / unknown token yields ONE uniform ISSUANCE_TOKEN_INVALID failure (ask the owner for a fresh token, never retry); MAX_KEYS_REACHED (409) means 3 active keys — the token was NOT consumed, retry with the SAME token after the owner revokes a key. After onboarding, use get_pricing to price metered work and get_credit_balance (with your new key) for the balance. No sandbox mirror; returns SANDBOX_TOOL_UNAVAILABLE under a sandbox bearer. Docs: https://www.apier.no/docs/authentication

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "token": "<token>"
    },
    "name": "redeem_issuance_token"
  }
}

Input Schema

Name	Required	Description	Default
`token`	Yes	The one-time key-issuance token the account owner minted in the Apier dashboard (Agent issuance tokens) and handed to you out-of-band. Single-use: it is consumed atomically on success. Never logged by Apier.

Output Schema

Name	Required	Description
`_meta`	No
`result`	Yes	The freshly issued API key: id, fixed name, read:* scopes, creation time, and the one-time plaintext_key.
`metadata`	Yes
`justification`	Yes

Schema Changelog

Changes observed during successful MCP inspections.

Changed1 schema field changedOct 13, 2026

changedOutput schema / description

Previous value: -"Rule 34 envelope; failures set result null + metadata.error_code / retryable / remediation. Contract: https://www.apier.no/docs/mcp"New value: +"Apier envelope; failures set result null + metadata.error_code / retryable / remediation. Contract: https://www.apier.no/docs/mcp"

Changed1 schema field changedOct 9, 2026
- changedOutput schema / properties / result / type
```
Previous value: -"object"New value: +[
+  "object",
+  "null"
+]
```

Changed20 schema fields changedAug 12, 2026

removedInput schema / $schema

Removed value: -"http://json-schema.org/draft-07/schema#"

removedOutput schema / $schema

Removed value: -"http://json-schema.org/draft-07/schema#"

removedOutput schema / additionalProperties
```
Removed value: -false
```

changedOutput schema / description

Previous value: -"The Apier MCP response envelope (SA-001 Rule 34): `result` (the tool's data) plus `justification` + `metadata`, and an optional `_meta`. Failure responses use the same envelope with `result: null` and `metadata` extended with `error_code` (stable closed vocabulary), `error_message`, `retryable` (whether repeating the identical call can plausibly succeed), `remediation` (one-sentence hint), and — when an upstream code was collapsed or renamed — the raw code on `upstream_code`."New value: +"Rule 34 envelope; failures set result null + metadata.error_code / retryable / remediation. Contract: https://www.apier.no/docs/mcp"

removedOutput schema / properties / _meta / additionalProperties
```
Removed value: -false
```

removedOutput schema / properties / _meta / description

Removed value: -"Optional `_meta` extension: the REST `is_sandbox` data marker plus the MCP `rate_limit` + `sandbox` markers (PR-MCP-SPEC-SYNC)."

removedOutput schema / properties / _meta / properties

Removed value: -{
-  "is_sandbox": {
-    "const": true,
-    "description": "Present + true ONLY when the result was generated from sandbox fixture DATA; absent (never false) otherwise. Distinct from `sandbox` (key type).",
-    "type": "boolean"
-  },
-  "rate_limit": {
-    "additionalProperties": false,
-    "description": "Advisory rate-limit headroom for the calling consumer (stamped on every tool result).",
-    "properties": {
-      "remaining": {
-        "anyOf": [
-          {
-            "type": "number"
-          },
-          {
-            "type": "null"
-          }
-        ],
-        "description": "The calling consumer's per-minute tier ceiling (null = the unlimited enterprise tier). Advisory headroom, NOT a live decremented count — the per-key bucket is enforced unchanged at the underlying REST route."
-      },
-      "reset_at": {
-        "description": "The current fixed-window reset instant, ISO 8601 with the Europe/Oslo offset.",
-        "type": "string"
-      }
-    },
-    "required": [
-      "remaining",
-      "reset_at"
-    ],
-    "type": "object"
-  },
-  "sandbox": {
-    "description": "true when the call used a test/sandbox key, false for a live key (stamped on every tool result). Distinct from `is_sandbox` (data mode).",
-    "type": "boolean"
-  }
-}

removedOutput schema / properties / _meta / type
```
Removed value: -"object"
```
removedOutput schema / properties / justification / additionalProperties
```
Removed value: -false
```

removedOutput schema / properties / justification / description

Removed value: -"Why-this-answer provenance (SA-001 Rule 34)."

removedOutput schema / properties / justification / properties

Removed value: -{
-  "rules_applied": {
-    "description": "Rule-engine versions / rule ids the response was evaluated against (e.g. `rulebook@2026.2.1`).",
-    "items": {
-      "type": "string"
-    },
-    "type": "array"
-  },
-  "source_data": {
-    "description": "Upstream sources the response is derived from (brreg, altinn, rulebook, norges_bank, ...).",
-    "items": {
-      "type": "string"
-    },
-    "type": "array"
-  },
-  "valid_until": {
-    "anyOf": [
-      {
-        "type": "string"
-      },
-      {
-        "type": "null"
-      }
-    ],
-    "description": "RFC 3339 UTC instant the upstream snapshot's freshness window expires, or null when the response is timeless."
-  }
-}

removedOutput schema / properties / justification / required

Removed value: -[
-  "rules_applied",
-  "source_data",
-  "valid_until"
-]

removedOutput schema / properties / justification / type
```
Removed value: -"object"
```
removedOutput schema / properties / metadata / additionalProperties
```
Removed value: -false
```
removedOutput schema / properties / metadata / description
```
Removed value: -"Call metadata (SA-001 Rule 34)."
```

removedOutput schema / properties / metadata / properties

Removed value: -{
-  "data_sources": {
-    "description": "Echo of the tool's declared dataSources.",
-    "items": {
-      "type": "string"
-    },
-    "type": "array"
-  },
-  "query_id": {
-    "description": "Per-call UUID v4 — joins to mcp_query_log.id for forensics.",
-    "type": "string"
-  },
-  "resolved_at": {
-    "description": "RFC 3339 UTC timestamp at envelope-build time (Z suffix).",
-    "type": "string"
-  },
-  "schema_version": {
-    "description": "MCP_SCHEMA_VERSION at the time the envelope was built.",
-    "type": "string"
-  },
-  "tool_name": {
-    "description": "The tool that produced the envelope.",
-    "type": "string"
-  }
-}

removedOutput schema / properties / metadata / required

Removed value: -[
-  "query_id",
-  "resolved_at",
-  "data_sources",
-  "schema_version",
-  "tool_name"
-]

removedOutput schema / properties / metadata / type
```
Removed value: -"object"
```
removedOutput schema / properties / result / additionalProperties
```
Removed value: -{}
```

removedOutput schema / properties / result / properties

Removed value: -{
-  "created_at": {
-    "description": "Key creation time, RFC 3339 UTC.",
-    "type": "string"
-  },
-  "id": {
-    "description": "The new API key's id (UUID).",
-    "type": "string"
-  },
-  "name": {
-    "description": "Server-fixed key label (\"Agent key (token-issued)\") — identifiable in the owner's dashboard.",
-    "type": "string"
-  },
-  "plaintext_key": {
-    "description": "The API key plaintext, returned EXACTLY ONCE. Store it immediately — it is never retrievable again and never logged.",
-    "type": "string"
-  },
-  "scopes": {
-    "description": "The issued key's scopes — always [\"read:*\"].",
-    "items": {
-      "type": "string"
-    },
-    "type": "array"
-  }
-}

AddedJul 24, 2026

TDQS

A4.6/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well past the annotations: single-use atomic consumption, plaintext_key returned exactly once, uniform error for expired/used/revoked/unknown tokens, a distinct 409 partial-failure state where the token is NOT consumed, and SANDBOX_TOOL_UNAVAILABLE on sandbox bearers. The 201/409 status semantics and 'one-time token IS the credential' framing are exactly the context an agent cannot infer from readOnlyHint=false / idempotentHint=false.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the core action before the caveats, and virtually every clause (failure modes, retry rule, sandbox behavior, docs link) carries operational weight. It is dense and long for a one-parameter tool, with the trailing sibling references (get_pricing/get_credit_balance) being the least essential sentence.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a mutating, non-idempotent, one-shot credential-exchange tool, the description covers success shape, failure taxonomy, recovery semantics, sandbox behavior, and a docs pointer. Listing the result fields is slightly redundant given the output schema, but harmless and reinforces the 'store it immediately' warning.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the parameter's own description already covers the token's origin, single-use atomicity, and non-logging. The tool description adds little beyond that (the credential framing is soft value), so the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource ('Convert an owner-issued key-issuance token into your own API key') and immediately scopes it as the headless onboarding step for an agent with no credential. It separates itself from siblings by noting minting/revocation are dashboard-only, so no agent-facing sibling competes for this action.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit when-to-use (agent holds no credential yet), explicit when-not-to-retry ('never retry' on ISSUANCE_TOKEN_INVALID), and an explicit recovery path for MAX_KEYS_REACHED (retry with the SAME token after owner revokes). It also routes the agent onward to get_pricing and get_credit_balance after onboarding.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Apier tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.