---
title: "Mint a Personal Access Token"
method: POST
path: "/api/companies/{companyId}/pats"
tags: ["Tokens"]
---

# Mint a Personal Access Token

`POST /api/companies/{companyId}/pats`

## Request

- Base URL: `https://comply.strac.io`
- URL: `https://comply.strac.io/api/companies/{companyId}/pats`
- Auth: HTTP bearer

Create a PAT for the REST API. Cognito-authenticated (you cannot mint a PAT with a PAT). The plaintext token is returned exactly once. Owners/admins can mint any scope; members and viewers can mint read-only scopes only.

Role gate: owner / admin (to mint write scopes).

Scope: `any`.

## Path parameters

- `companyId` string, required

## Request body

- object
  - `label` string, required: Shows in the token list in Settings.
  - `scopes` string[], required: Least-privilege scope set; each must be a canonical scope.
  - `expiresInDays` 0 | 30 | 90 | 365, required: Token lifetime in days. 0 = never expires (service accounts).

## Response `201`

Mint a Personal Access Token

---

[API](https://skmtc.dev/strac/apis/strac-comply-api.md) - [All operations](https://skmtc.dev/strac/apis/strac-comply-api/llms.txt) - [OpenAPI document](https://skmtc.dev/strac/apis/strac-comply-api/revisions/d5558b64eeeb?raw)