---
title: "Create a machine access credential"
method: POST
path: "/v1/spaces/{spaceId}/machine-credentials"
tags: ["Access"]
---

# Create a machine access credential

`POST /v1/spaces/{spaceId}/machine-credentials`

## Request

- Base URL: `https://api.spacefast.com`
- URL: `https://api.spacefast.com/v1/spaces/{spaceId}/machine-credentials`
- Auth: HTTP bearer

Creates a scoped grant and returns its opaque bearer token exactly once. Tokens are accepted only in the Authorization header.

## Path parameters

- `spaceId` string, required

## Request body

- object
  - `name` string, required
  - `resources` object, required
    - `include` string[], required
    - `exclude` string[]
  - `capabilities` string[], required
  - `constraints` object
    - `notBefore` union
      - string, date-time
      - string
    - `expiresAt` union
      - string, date-time
      - string
    - `maxUses` integer
    - `requireVerifiedEmail` boolean
    - `network` object
      - `ipCidrs` string[]: IP address and CIDR Grants are unsupported because the serving runtime has no trusted visitor IP. Remove the IP constraint.
      - `countries` string[]
      - `excludedCountries` string[]
      - `excludedUserAgentSubstrings` string[]
    - `frameOrigin` string
  - `target` union, required
    - object
      - `kind` 'live', required
    - object
      - `kind` 'version', required
      - `versionId` string, required
    - object
      - `kind` 'branch', required
      - `branch` string, required
    - object
      - `kind` 'all_versions', required

## Response `201`

Response for status 201

- object
  - `$schema` string, uri: Canonical JSON Schema URL for this response body. The server also sends it in the `Link: rel="describedby"` response header.
  - `data` object, required
    - `credential` object, required
      - `id` string, required
      - `grant` object, required
        - `grant` object, required
          - `name` string
          - `audience` union, required
            - object
              - …
            - object
              - …
            - object
              - …
            - object
              - …
            - object
              - …
            - object
              - …
            - object
              - …
          - `resources` object, required
            - `include` string[], required
            - `exclude` string[], required
          - `capabilities` string[], required
          - `constraints` object, required
            - `notBefore` union
              - …
            - `expiresAt` union
              - …
            - `maxUses` integer
            - `requireVerifiedEmail` boolean
            - `network` object
              - …
            - `frameOrigin` string
          - `target` union, required
            - object
              - …
            - object
              - …
            - object
              - …
            - object
              - …
          - `id` string, required
          - `source` object, required
            - `kind` 'config' | 'managed' | 'system', required
            - `reference` string, required
        - `generation` integer, required
        - `status` 'scheduled' | 'active' | 'expired', required
        - `sourceExplanation` object, required
          - `editable` boolean, required
          - `label` string, required
          - `detail` string, required
        - `createdAt` string, date-time, required
        - `updatedAt` string, date-time, required
      - `tokenHint` string, required
      - `rotatedAt` string, date-time, nullable, required
      - `lastUsedAt` string, date-time, nullable, required
      - `revokedAt` string, date-time, nullable, required
    - `token` string, required

## Other responses

- `default`: Problem details (RFC 9457). Any 4xx/5xx response is one `application/problem+json` document.

---

[API](https://skmtc.dev/spacefast/apis/spacefast-api.md) · [All operations](https://skmtc.dev/spacefast/apis/spacefast-api/llms.txt) · [OpenAPI document](https://skmtc.dev/spacefast/apis/spacefast-api/revisions/bd165bc7c983?raw)