Create an API token
curl --request POST \
--url https://my.server.express/api/v1/user/tokens \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"name": "<string>",
"scopes": [],
"expiresInDays": 1825.5
}
'const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({name: '<string>', scopes: [], expiresInDays: 1825.5})
};
fetch('https://my.server.express/api/v1/user/tokens', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://my.server.express/api/v1/user/tokens"
payload = {
"name": "<string>",
"scopes": [],
"expiresInDays": 1825.5
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text){
"success": true,
"data": {
"id": "<string>",
"name": "<string>",
"prefix": "<string>",
"scopes": [
"services:read"
],
"expiresAt": "2023-11-07T05:31:56Z",
"createdAt": "2023-11-07T05:31:56Z",
"token": "<string>"
}
}{
"success": false,
"error": "<string>"
}{
"success": false,
"error": "<string>"
}{
"success": false,
"error": "<string>"
}{
"success": false,
"error": "<string>"
}{
"success": false,
"error": "<string>"
}API Tokens
Create an API token
Mints a token and returns the plaintext once — it’s never stored and can’t be shown again. Max 20 live tokens (409). Duplicate scopes are collapsed. Writes an API_TOKEN_CREATED audit entry (scopes only, never the token).
POST
/
v1
/
user
/
tokens
Create an API token
curl --request POST \
--url https://my.server.express/api/v1/user/tokens \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"name": "<string>",
"scopes": [],
"expiresInDays": 1825.5
}
'const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({name: '<string>', scopes: [], expiresInDays: 1825.5})
};
fetch('https://my.server.express/api/v1/user/tokens', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://my.server.express/api/v1/user/tokens"
payload = {
"name": "<string>",
"scopes": [],
"expiresInDays": 1825.5
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text){
"success": true,
"data": {
"id": "<string>",
"name": "<string>",
"prefix": "<string>",
"scopes": [
"services:read"
],
"expiresAt": "2023-11-07T05:31:56Z",
"createdAt": "2023-11-07T05:31:56Z",
"token": "<string>"
}
}{
"success": false,
"error": "<string>"
}{
"success": false,
"error": "<string>"
}{
"success": false,
"error": "<string>"
}{
"success": false,
"error": "<string>"
}{
"success": false,
"error": "<string>"
}Authorizations
Session access token (JWT) from POST /v1/auth/login or /v1/auth/refresh. A session satisfies every API scope.
Body
application/json
Trimmed; cut to 80 characters.
Minimum string length:
1Minimum array length:
1Available options:
services:read, services:stats, services:power, services:rescue, services:reinstall, services:cancel, snapshots:read, snapshots:write, catalogue:read, orders:place, invoices:read, invoices:pay, tickets:read, tickets:write Null or omitted for a token that never expires.
Required range:
1 <= x <= 3650