---
title: "Delegate To Agent"
method: POST
path: "/delegations"
tags: ["delegations"]
---

# Delegate To Agent

`POST /delegations`

## Request

- Base URL: `https://app.tascan.io/api/v1`
- URL: `https://app.tascan.io/api/v1/delegations`
- Auth: HTTP bearer

Mint a time-limited, NARROWER child API key (POST /delegations, roadmap #11) — only read/write scopes may be requested; full, agent:dispatch, agent:dispatch:code, device:admin, delegate and webhooks:manage are always refused by name (I-6). TTL defaults to 1 hour (3600s), clamps to [60 seconds, 24 hours], and clamps further to THIS key's own expiry if it has one — a delegated key can never outlive its grantor. The child's tier is always a SUBSET of this key's own effective tier, never wider or lateral. Requires the delegate permission (owner-only to grant, requires full). The returned raw key is shown to you exactly ONCE — it is never stored server-side and cannot be retrieved again (I-10). Revoking this key (or any ancestor) cascades immediately to every key it delegated.

## Request body

- object
  - `scopes` string[], required: Scopes to request for the child key — read and/or write only.
  - `ttl_seconds` number: How long the child key lives, in seconds (default 3600 = 1h; clamped to [60, 86400] and to this key's own expiry).
  - `resource_constraints` object: Optional free-form narrowing (e.g. project/list ids) recorded on the child key as metadata.

## Response `200`

Success. JSON body: { data: ... } or an error object { error, message }.

## Other responses

- `4XX`: Client error (validation, auth, scope, rate limit).

---

[API](https://skmtc.dev/tascan/apis/tascan-api.md) · [All operations](https://skmtc.dev/tascan/apis/tascan-api/llms.txt) · [OpenAPI document](https://skmtc.dev/tascan/apis/tascan-api/revisions/56fcd2861498?raw)