---
title: "Mint the bridge-scoped vault viewer token"
method: POST
path: "/agent/v1/control-plane/session/viewer-token"
tags: ["ControlPlaneAuth"]
---

# Mint the bridge-scoped vault viewer token

`POST /agent/v1/control-plane/session/viewer-token`

## Request

- Base URL: `https://api.run402.com`
- URL: `https://api.run402.com/agent/v1/control-plane/session/viewer-token`
- Auth: HTTP bearer

vault-recovery-custody (consult round 1): the console key bridge seals THIS token — never the full control-plane bearer — to git.run402.com. Scope is structural and read-only: only the vault read routes plus whoami and the org/project list reads accept it; every write surface rejects the bearer by token class. Bound to the parent session's row (sign-out or admin revoke kills it; the 12h absolute cap bounds it; an access refresh does not break it), 30-minute expiry, non-refreshable.

## Response `200`

Minted

- object
  - `viewer_token` string
  - `expires_in` integer: Seconds.
  - `scope` string[]

---

[API](https://skmtc.dev/run402/apis/run402-api.md) · [All operations](https://skmtc.dev/run402/apis/run402-api/llms.txt) · [OpenAPI document](https://skmtc.dev/run402/apis/run402-api/revisions/893607557f50?raw)