SIsignal18
Auth

List or create the caller's API tokens

Changed on

GET lists the caller's tokens (token strings included for an interactive login). POST (grant token-create, interactive login only) issues a new token narrowed to a subset of the caller's own grants and a cluster scope; the token can never carry a grant the caller does not hold. The system service account can never issue tokens.

post/api/tokens

Request

  • The document declares no server URL.
  • Auth
    none declared. Required headers: Authorization

Headers

Authorizationstring required

Insert your access token

Request body

clustersstring[]

empty or ["*"] = every cluster the owner can see

expireDaysinteger

0 = server default (api-user-tokens-default-expire-days); -1 = never

grantsstring

compact prefixes, space separated, e.g. "db-show proxy"; empty = all of the owner's grants

labelstring

Response

OK

clustersstring[]

cluster scope; ["*"] = all

createdAtstring
createdFromstring
expiredboolean
expiresAtstring
grantsstring[]

compact grant prefixes requested by the owner

idstring
labelstring
lastUsedAtstring
lastUsedFromstring
ownerAuthTypestring

OwnerAuthType is how the owner was authenticated when the token was issued ("SSO" or "Local"): a token issued by a Cloud18 identity keeps that identity for the self-service rules, which need an SSO caller.

revokedboolean
revokedAtstring
revokedBystring
tokenstring
userstring

Changes