---
title: "Issue API user pairing token"
method: POST
path: "/management/api_users/{userId}/pairing_token"
tags: ["Api User"]
---

# Issue API user pairing token

`POST /management/api_users/{userId}/pairing_token`

## Request

- Base URL: `https://api.fireblocks.io/v1`
- URL: `https://api.fireblocks.io/v1/management/api_users/{userId}/pairing_token`
- Auth: none declared
- TypeScript: <https://skmtc.dev/fireblocks/apis/fireblocks-api/docs/management/api_users/:userId/pairing_token/post.ts> (a function with typed inputs; its response is checked against the schema)

Issues a device pairing token for the given user and returns the user's info along with the token.
- The API user must be in PENDING_ACTIVATION status. If the user is already set up (enabled), the request is rejected with a 409 Conflict.
- Please note that this endpoint is available only for API keys with Owner/Admin/Non Signing Admin permissions.
- This is the same pairing token that the API Co-signer requests during installation and when you pair an additional API user with an existing Co-signer. You can use this endpoint instead of copying the token from Pair API user in the Console. The token is valid for one hour.

## Path parameters

- `userId` string, required

## Headers

- `Idempotency-Key` string

## Response `201`

Pairing token issued

- IssueApiUserPairingTokenResponse
  - `id` string, required: The unique identifier of the user
  - `name` string: The name of the user
  - `role` 'OWNER' | 'ADMIN' | 'SIGNER' | 'COLLATERALS_SIGNER' | 'EDITOR' | 'APPROVER' | 'VIEWER' | 'NON_SIGNING_ADMIN' | 'AUDITOR' | 'NCW_ADMIN' | 'NCW_SIGNER' | 'SECURITY_ADMIN' | 'SECURITY_AUDITOR', required: The role of the user
  - `enabled` boolean, required: Whether the user is enabled
  - `userType` 'API' | 'CONSOLE': The type of the user
  - `status` 'PENDING_ACTIVATION' | 'PENDING_DEVICE_PAIRING' | 'PENDING_DEVICE_SETUP' | 'READY': The status of the user
  - `pairingToken` string, required: The device pairing token issued for the given user

## Other responses

- `401`: Unauthorized. Missing / invalid JWT token in Authorization header.
- `403`: Lacking permissions.
- `404`: API user not found for the given userId.
- `409`: Conflict. The API user is not in PENDING_ACTIVATION status (e.g. already set up / enabled).
- `5XX`: Internal error.
- `default`: Error Response

---

[API](https://skmtc.dev/fireblocks/apis/fireblocks-api.md) - [All operations](https://skmtc.dev/fireblocks/apis/fireblocks-api/llms.txt) - [OpenAPI document](https://skmtc.dev/fireblocks/apis/fireblocks-api/revisions/4eba9965659a?raw)