API reference · Identity and tokens
Create an API token
POST
/v1/orgs/{org}/api-tokensCreate an API token. The secret is returned once
- Permission
iam.api_tokens.manage- Audit log
iam.api_token.create- Operation
iam.api_tokens.create
Parameters
| Name | In | Type | Required | Notes |
|---|---|---|---|---|
org | path | string | yes | for example "org_01h455vb4pex5vsknk084sn02q" |
Idempotency-Key | header | string | no | One key per intended mutation. A retry with the key never executes twice; its response carries a secret and is not replayed: a duplicate answers 409 idempotency_outcome_committed. For example "01h455vb4pex5vsknk084sn02q" |
x-obhut-management-assignment | header | string | no | Select one staff assignment. Direct membership remains the default. Bound API tokens use their stored source and ignore this selector. For example "masg_01h455vb4pex5vsknk084sn02q" |
Request body
| Field | Type | Required | Notes |
|---|---|---|---|
name | string | yes | 1 to 100 characters |
permissions | array of string | yes | 1 to 100 items |
expiresAt | string (date-time) | no | UTC, ISO 8601. |
Response 201
| Field | Type | Required | Notes |
|---|---|---|---|
id | string | yes | for example "token_01h455vb4pex5vsknk084sn02q" |
name | string | yes | 1 to 100 characters |
permissions | array of string | yes | |
createdAt | string (date-time) | yes | UTC, ISO 8601. |
expiresAt | string (date-time) or null | yes | |
lastUsedAt | string (date-time) or null | yes | |
management | object or null | yes | |
management.assignmentId | string | yes | for example "masg_01h455vb4pex5vsknk084sn02q" |
management.linkId | string | yes | for example "mlink_01h455vb4pex5vsknk084sn02q" |
management.providerOrgId | string | yes | for example "org_01h455vb4pex5vsknk084sn02q" |
sourceEnded | boolean | yes | |
expired | boolean | yes | |
secret | string | yes | Bearer token. Shown once, never stored in clear. |