Restriction options for token attenuation.

Create limited-scope versions of your token for delegation or integration with external services. All restrictions are additive—the resulting token can only perform a subset of what the original could do.

Quick Options

For common use cases, use the convenience flags:

• read_only: true — Restrict to read operations only (list, read)
• non_destructive: true — Allow all operations except delete

Fine-Grained Control

For precise control, use explicit whitelists:

• allowed_actions — Permit only specific operations
• allowed_resources — Permit only specific resource types

Timezone

All timestamps use UTC in ISO 8601 / RFC 3339 format.

Examples

Read-only delegation for a reporting dashboard:

{
  "token": "abs0_FLOWBIO1...",
  "attenuation": { "read_only": true }
}

Time-limited token expiring in 1 hour:

{
  "token": "abs0_FLOWBIO1...",
  "attenuation": { "expires_at": "2026-01-20T13:00:00Z" }
}

Restrict to specific actions and resources:

{
  "token": "abs0_FLOWBIO1...",
  "attenuation": {
    "allowed_actions": ["list", "read"],
    "allowed_resources": ["experiment", "result"]
  }
}

Combine multiple restrictions (read-only, time-limited, org-scoped):

{
  "token": "abs0_FLOWBIO1...",
  "attenuation": {
    "read_only": true,
    "expires_at": "2026-01-21T00:00:00Z",
    "allowed_org_ids": ["56a01500-1f17-4908-a6a8-472e349e5733"]
  }
}

Further Reading

For details on the cryptographic properties of token attenuation, see the Biscuit documentation.