This endpoint allows a partner to add an API key to one of its child partners from the Partner Portal. A portal user who was removed from the partner or deactivated is refused with INVALID_ACCESS even with a still-valid token. Partner Portal session only: the request must carry the Partner Portal bearer token of a user with the Admin role, and the partner must have both AccountCredentialsAccess and PartnerCreationEnabled. The target must be an Active child partner of the caller. Returns RESOURCE_NOT_FOUND when it is not. Retrieve, add, edit and delete are recorded in an audit log with the Partner Portal user, and the request fails if the entry cannot be written.