Hi,

after creating an accesskey in Airnotifier using the API:

curl -i -H "Accept: application/json" -H "X-AN-APP-NAME: moodle" -X POST -d "url=sitemoodleurl&siteid=12EFab765" http://localhost:8801/accesskeys/

I have noticed that the key doesn't have any type of permissions enabled.

I think that at least these permissions should be enabled by default:
-Create token
-Delete token
-Notification

Without these permissions Moodle sites that have created an Acces key using the API can't do anything

It will be also interesting if the API supports also "description" and "contact email" as POST params, in the same way you can add this fields when you add a key manually. This will help us to display which API key belongs to which site and also a contact email for reporting abuse, etc...