NUnullplatform
Personal access tokens

Create a personal access token

Changed on

Creates a personal access token that acts as you. It either follows your access (access: same_as_user) or holds the grants you send (access: grants), and every check combines it with your access at that moment, so it can never do more than you.

ℹ️ Note: Personal access tokens are managed with your own login session. A request authenticated with an API key, a personal access token included, is rejected with a 403.

post/pat

Request

  • Base URL
    https://api.nullplatform.com
  • URL
    https://api.nullplatform.com/pat
  • Auth
    HTTP bearer

Request body

namestring required

A descriptive name for the token, for example where it runs.

expires_ininteger

How long the token lives, in seconds (at least 60), counted from the server's clock when it receives the request. Send this or expires_at, not both.

The expiration it resolves to must be at most a year away. Prefer expires_in over expires_at: because it counts from the server's clock, a lifetime at the limit isn't rejected when your own clock runs ahead. Only expires_at is stored and returned.

expires_atstring date-time

The ISO-8601 UTC timestamp of when the token stops working. It must be in the future and at most a year away. Send this or expires_in, not both.

access'grants' | 'same_as_user'

What the token can do.

  • same_as_user: the token follows your access in the organization, including roles you get or lose later. Send no grants.
  • grants: the token holds only the grants you send.

Either way, every check combines the token's access with yours at that moment.

Example request

{
  "name": "local-scripts",
  "expires_in": 2592000,
  "expires_at": "2027-01-06T00:00:00Z",
  "access": "same_as_user",
  "grants": [
    {
      "nrn": "organization=1:account=1:namespace=1:application=4",
      "role_slug": "machine:ci"
    }
  ],
  "tags": [
    {
      "key": "team",
      "value": "platform"
    }
  ]
}

Response

The operation was successful.

idinteger required

Unique ID for the token.

namestring required

The descriptive name given to the token.

masked_api_keystring

The token, masked.

access'grants' | 'same_as_user' required

Whether the token follows your access (same_as_user) or holds its own grants (grants).

personalboolean

Always true for a personal access token.

owner_idinteger

The ID of the user who created the token.

acting_user_idinteger

The ID of the user the token acts as: you.

last_used_atstring date-time nullable

The ISO-8601 UTC timestamp of when the token was last exchanged for an access token.

expires_atstring date-time required

The ISO-8601 UTC timestamp of when the token stops working.

expiredboolean

Whether the token has expired.

created_atstring date-time required

The ISO-8601 UTC timestamp of when the token was created.

updated_atstring date-time required

The ISO-8601 UTC timestamp of when the token was last updated.

api_keystring required

Your new personal access token.

⚠️ Save your token securely.

The token is displayed only once. Make sure to store it in a secure location as it cannot be retrieved later.

Example response

{
  "id": 1234,
  "name": "local-scripts",
  "masked_api_key": "AAAAxxxxxPTs=",
  "access": "same_as_user",
  "tags": [
    {
      "key": "team",
      "value": "platform"
    }
  ],
  "grants": [
    {
      "id": 5678,
      "nrn": "organization=1:account=2",
      "role_id": 700317756,
      "role_slug": "developer",
      "actions": [
        "application:read",
        "deployment:create"
      ]
    }
  ],
  "personal": true,
  "owner_id": 42,
  "acting_user_id": 42,
  "last_used_at": "2026-10-08T12:00:00.000Z",
  "expires_at": "2027-01-06T00:00:00.000Z",
  "created_at": "2026-10-08T00:00:00.000Z",
  "updated_at": "2026-10-08T00:00:00.000Z",
  "api_key": "AAAA.1234567890abcdef1234567890abcdefPTs="
}

Changes