---
title: "Create a personal access token"
method: POST
path: "/api/connections/pat"
tags: ["Connections"]
---

# Create a personal access token

`POST /api/connections/pat`

## Request

- Base URL: `https://api.engram.page`
- URL: `https://api.engram.page/api/connections/pat`
- Auth: HTTP bearer

The raw `key` is returned once. Any plan can create a key, and it works on every route (REST, MCP, sync sockets) on every plan, rate limited per user (`api_rps_cap`).

## Request body

- CreatePatRequest
  - `default_access` 'none' | 'read' | 'write': Level for every vault not listed in `vault_access`, including vaults you create later. Defaults to `none` when `vault_access` is given. `write` also lets the key create vaults. The key must reach at least one vault now or later.
  - `name` string, required
  - `vault_access` object: Level per vault id: `none`, `read` (search and read) or `write` (also create, edit, rename and delete notes, and rename or delete the vault). Every id must be one of your vaults. Omit both this and `default_access` for a key on every vault with full write access.

## Response `201`

Created (raw key)

- ApiKeyCreated
  - `default_access` 'none' | 'read' | 'write', required: The granted level for every vault not in `vault_access`, including later ones.
  - `id` string, uuid, required
  - `key` string, required: Raw secret — store it now; never shown again.
  - `name` string, required
  - `vault_access` object, required: What the key was granted, read back from storage: a level per listed vault id. Compare it with what you asked for; revoke the key if it is wider.

## Other responses

- `422`: Blank/invalid name

---

[API](https://skmtc.dev/engram/apis/engram-api.md) · [All operations](https://skmtc.dev/engram/apis/engram-api/llms.txt) · [OpenAPI document](https://skmtc.dev/engram/apis/engram-api/revisions/8c4c2eec29dc?raw)