Skip to navigation
API referenceOrganizationsService tokens

Create a service token

Required scopes: token.create.

Creates an organization-owned service identity without a user or member seat. Requested scopes must be a subset of the issuer scopes. This operation is not idempotent; do not automatically retry an ambiguous response. Idempotency-Key is unsupported and rejected with 422 idempotency_not_supported. No secret-bearing response or one-use download stream is retained.

Response headers:

  • Location (201): Relative URL of the created resource.

Authentication

AuthorizationBearer

Organization-owned service token. Issue the initial token in organization credential settings. Scopes are documented per operation via x-required-scopes; they are not OAuth scopes.

Path parameters

organization_idstringRequiredformat: "uuid"
Immutable organization UUID bound to the service token.

Request

This endpoint expects an object.
labelstringRequired1-128 characters

At most 128 UTF-8 bytes.

scopeslist of enumsRequired

Every scope must be held by the issuer; duplicate entries are normalized.

expires_atinteger or nullOptional

Future Unix seconds, at most 90 days ahead. Omit for 30 days; null explicitly permits no expiration.

Response headers

X-Request-IdstringOptional

Server-generated correlation ID.

LocationstringOptional
Relative URL of the created resource.

Response

Created
idstring
organization_idstringformat: "uuid"
labelstring
scopeslist of enums
expires_atinteger or null

Unix timestamp in seconds; null means no deadline or no recorded use.

secretstringformat: "^svc_[a-f0-9]{64}$"
Returned once. Store in a confidential backend.

Errors

401
Unauthorized Error
403
Forbidden Error
404
Not Found Error
429
Too Many Requests Error
503
Service Unavailable Error