API referenceKeys
Create a child key
POST /v1/keys
POST https://api.healthcare.dev/v1/keysCreate a child key on your account, with optional scopes (the route groups it may call), its own requests-a-second limit and a monthly spend cap. Its calls bill to your account and count toward your account's quota, rate limit and spend cap, which still apply. The full key is in this response only; store it now. Call with a parent key. Pro and Team.
Requires an API key: Authorization: Bearer hdev_live_.... See Authentication.
Request body
{
"name": "string",
"env": "live",
"scopes": [
"codes"
],
"rps_limit": 1,
"monthly_cap_cents": 0
}Examples
curl
curl -X POST "https://api.healthcare.dev/v1/keys" \
-H "Authorization: Bearer $HDEV_API_KEY"TypeScript
const res = await fetch("https://api.healthcare.dev/v1/keys", {
method: "POST",
headers: { Authorization: `Bearer ${process.env.HDEV_API_KEY}` },
});
const { data, meta } = await res.json();Python
import os
import requests
res = requests.post("https://api.healthcare.dev/v1/keys", headers={"Authorization": f"Bearer {os.environ['HDEV_API_KEY']}"})
body = res.json()Try it
Response
Created; data.key is the full key, shown once
{
"data": {
"id": "string",
"name": "string",
"prefix": "string",
"env": "live",
"scopes": [
"codes"
],
"rps_limit": 1,
"monthly_cap_cents": 1,
"month_to_date": {
"calls": 1,
"spend_cents": 1
},
"created_at": "string",
"last_used_at": "string",
"revoked_at": "string",
"key": "string"
},
"meta": {
"source": "cms-icd10",
"data_version": "2026.1",
"retrieved_at": "2026-10-24T12:00:00Z",
"license": "Public domain (CMS). Reference data, not medical advice."
},
"links": {
"self": "/v1/keys",
"next": null
}
}Errors
Errors are application/problem+json (RFC 9457). Branch on type, not on title. See Errors.
| Status | type | When |
|---|---|---|
| 400 | invalid-request | A parameter or the body failed validation; errors lists each field. |
| 401 | unauthorized | Missing, malformed or revoked API key. |
| 403 | plan-upgrade-required | The plan doesn't include this feature; required_plan names the plan that does. |
| 409 | The account already holds the most active child keys allowed | |
| 429 | rate-limited / quota-exceeded | Too many requests per second (retry after Retry-After), or the monthly quota is used up. |