---
title: "Mint Global Admin Token"
method: POST
path: "/global-admin/tokens"
---

# Mint Global Admin Token

`POST /global-admin/tokens`

## Request

- Base URL: `https://api-docs.session-exchange.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api-docs.session-exchange.com/global-admin/tokens`
- Auth: none declared

Mint a global-admin token. Only an existing global admin (or break-glass) may
mint one — tenant admins (incl. the default/home admin) cannot. The first-run
bootstrap mints the initial global admin; break-glass is the ultimate recovery.
Returns the plaintext once; only the hash is stored.

#1114 (owner default A): a listed person's elevated browser SESSION may not mint one: a lasting
global-admin token would outlive the 12 h elevation and the session itself. Minting stays behind
a pasted global-admin token or break-glass (`require_global_admin_token`: 403, `details.reason` =
`pasted_token_required`, audited).

## Request body

- GlobalAdminTokenRequest: Mint a global-admin token (specs/multi-tenancy/v0.1 Phase 2). Minted only by an existing global admin (or break-glass).
  - `label` string
  - `owner_id` string
  - `user_id` string

## Response `200`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/session-exchange/apis/a4sx.md) · [All operations](https://skmtc.dev/session-exchange/apis/a4sx/llms.txt) · [OpenAPI document](https://skmtc.dev/session-exchange/apis/a4sx/revisions/abaefc33dfc7?raw)