---
title: "Mint App Scope Token"
method: POST
path: "/mounts/{mount_id}/apps/scope"
tags: ["Mounts"]
---

# Mint App Scope Token

`POST /mounts/{mount_id}/apps/scope`

Issue a folder-scoped token for a running HTML app.

The browser asks for one when the person grants an app access, then attaches it to every
bridge call so the server can refuse a path outside the folder. It only ever narrows what
the caller already has, so minting is gated on the level being asked for: read-write needs
EDIT_MOUNTS, exactly as the write itself does.

## Path parameters

- `mount_id` string, uuid, required

## Request body

- AppScopeRequest — Ask for a folder-scoped token for one app. `dir` is mount-relative.
  - `dir` string, required
  - `level` 'read' | 'read-write'

## Response `200`

Successful Response

- AppScopeResponse — The token the browser attaches to every bridge call, and when it stops working.
  - `token` string, required
  - `expires_at` integer, required
  - `dir` string, required
  - `level` string, required

## Other responses

- `422` — Validation Error

## Changes

- **2026-09-23** `89054d43d2f0` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/agenta-ai/apis/agenta-api/changes/mounts/:mount_id/apps/scope/post.md)

---

[API](https://skmtc.dev/agenta-ai/apis/agenta-api.md) · [All operations](https://skmtc.dev/agenta-ai/apis/agenta-api/llms.txt) · [OpenAPI document](https://skmtc.dev/agenta-ai/apis/agenta-api/revisions/72f2feba8ccb?raw)