---
title: "Generate access token for submission"
method: POST
path: "/api/forms/{formId}/submissions/{submissionId}/access-token"
tags: ["Forms"]
---

# Generate access token for submission

`POST /api/forms/{formId}/submissions/{submissionId}/access-token`

Creates a signed token for sharing submission access with granular permissions. Expiry is 1–86400 minutes (up to 60 days).

## Path parameters

- `formId` integer, required
- `submissionId` integer, required

## Request body

- CreateAccessTokenRequest — Request to generate access token.
  - `expiryMinutes` integer, required — Token expiry time in minutes.
  - `permissions` string[], required — Array of permissions to grant (view, edit, export).

## Response `200`

Access token generated successfully

- CreateAccessTokenResponse — Response containing the generated access token.
  - `token` string
  - `expiresAt` string, date-time
  - `permissions` string[]

## Other responses

- `400` — Invalid input data
- `401` — Unauthorized
- `403` — Forbidden

## Changes

- **2026-07-27** `849553bde436` — 1 info
  - the `expiryMinutes` request property's max was increased from `10080.00` to `86400.00`
- **2026-02-06** `a99906323223` — 1 info
  - endpoint added
- **2025-03-24** `fbc3fe6ecbf1` — 1 breaking
  - api path removed without deprecation

[Change history](https://skmtc.dev/endatix/apis/endatix-platform-rest-api/changes/api/forms/:formId/submissions/:submissionId/access-token/post.md)

---

[API](https://skmtc.dev/endatix/apis/endatix-platform-rest-api.md) · [All operations](https://skmtc.dev/endatix/apis/endatix-platform-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/endatix/endatix-platform-rest-api/revisions/01bd299fd100/schema)