Tokens

Create a personal API token; plaintext is returned once

Requires admin token scope or the web session. Read and write tokens receive 403 FORBIDDEN. Optional workspace (slug), scope (read/write/admin, default admin), and future expiresAt limit the token. Sessions and unlimited parents default to every workspace and no expiry. Omitted audience/expiry inherit finite parent limits; inherited audience still requires current membership. An unknown or outside workspace answers 404 NOT_FOUND (Workspace not found); expiry later than the parent answers 403 FORBIDDEN. Idempotency fingerprints include effective resolved limits: a cached broader token cannot be replayed under narrower limits (422 IDEMPOTENCY_KEY_REUSED).

post/api/tokens

Request

  • Base URL: https://tre-app.com
  • URL: https://tre-app.com/api/tokens
  • Auth: HTTP bearer

Headers

Idempotency-Keystring

Opaque 1–200 character key. The same user, endpoint, and key replay the cached response for 24 hours when the request body fingerprint matches. A reused key with a different body answers 422 IDEMPOTENCY_KEY_REUSED; the same key while the original is still in flight answers 409 CONFLICT.

Request body

namestring required
workspacestring
scope'read' | 'write' | 'admin'
expiresAtstring date-time

Response

Success

idstring uuid required
namestring required
prefixstring required
kind'personal' | 'oauth' required
scope'read' | 'write' | 'admin' required
workspaceIdstring uuid nullable required
clientIdstring nullable required
grantIdstring uuid nullable required

OAuth grant id when kind is oauth; null for personal tokens.

expiresAtstring date-time nullable required
lastUsedAtstring date-time nullable required
createdAtstring date-time required
revokedAtstring date-time nullable required
plaintextstring required

Changes

No recorded changes to this operation across all 1 revision of this API.