api_key_already_issued
POST /v1/onboarding/api-key has already handed this tenant its first key, and that secret is shown exactly once. The route is deliberately first-key-only - a general session-authenticated mint would duplicate POST /v1/api-keys under a browser cookie, which is a weaker credential than the API key that route requires - so the cure is POST /v1/api-keys with the key already held. The uniqueness is enforced by a guarded UPDATE on the never-delivered provisioning key rather than by an Idempotency-Key, which this pre-key surface cannot carry; a double-submit therefore answers with this rather than minting twice.
Problem shape
Every non-2xx response is an RFC 9457 application/problem+json body. The type URI below is stable and machine-matchable, so branch on the final path segment (the code) and treat the status as redundant confirmation. See the error-handling guide.
{
"type": "https://docs.vocapable.com/errors/api_key_already_issued",
"title": "…",
"status": 409,
"detail": "…",
"instance": "/v1/…"
}