Mint a build grant token
A build grant for one person, for MCP or the REST person routes. It reads places and menus, builds and reads carts, releases a cart it built, and confirms after the person says yes, with the 6-digit code Layout texts them whenever one is due (codeReason on the cart says why), which the person relays to you. It cannot add a card. GET /orders/{orderId} reads only the orders this application's grants built for that person. A sandbox grant confirms as a simulation that places and charges nothing, with no code except at test_place_code (000000). A grant lasts 15 minutes. To keep a session going, send the current grant as refresh before it expires: the same token lasts another 15 minutes, up to 24 hours from when it was minted, and no build-session allowance is drawn. The body is optional.
Request
- Base URL: https://api.layout.link/v1
- URL: https://api.layout.link/v1/users/{userId}/grant
- Auth: HTTP bearer
Path parameters
Headers
The API version you code against. Optional; without it you get 2026-10-01, the current version. Layout answers with the version it used.
Optional. Any 1 to 255 visible ASCII characters, unique per real intent. A retry with the same key and the same body gets the stored response for 24 hours, with Idempotent-Replayed: true, and is never run twice. The same key with a different body is 409 idempotency_conflict; while the first request is still running it is 409 in_progress with Retry-After. Only a success is stored: any error releases the key so it can be sent again. A 4xx ran nothing. A 5xx may have run, above all a confirm's 500, so read the resource before sending anything changed.
Request body
Example request
{
"refresh": "lgb_9f3a2c"
}Response
The grant sent as refresh, extended.
Example response
{
"token": "lgb_9f3a2c"
}Changes
No recorded changes to this operation across all 1 revision of this API.