Skip to content
SupaCloud Docs
Select themeSelect language

post_api_management_v1_api_tokens

POST
/api/management/v1/api-tokens
curl --request POST \
  --url https://example.com/api/management/v1/api-tokens \
  --header 'Content-Type: application/json' \
  --data '{ "expires_at": "2026-04-15T12:00:00Z", "label": "example", "scopes": [ "example" ] }'

Authorizations

Section titled “Authorizations”

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json
object
expires_at
string | null format: date-time
label
required
string
scopes
Array<string> | null
Examplegenerated
{
  "expires_at": "2026-04-15T12:00:00Z",
  "label": "example",
  "scopes": [
    "example"
  ]
}

Responses

Section titled “ Responses ”

200

Section titled “200”

An instance-level token limited to the runner scopes, shown once

Media typeapplication/json
object
created_at
required
string format: date-time
expires_at
string | null format: date-time
fingerprint
required
string
id
required
string format: uuid
label
required
string
last_used_at
string | null format: date-time
organization_id

#987 Stage A — set when the token is bound to an ORGANIZATION instead of a single workspace. Both null is the global/bootstrap shape.

string | null format: uuid
revoked_at
string | null format: date-time
scopes
required
Array<string>
token
string | null
workspace_id
string | null format: uuid
Examplegenerated
{
  "created_at": "2026-04-15T12:00:00Z",
  "expires_at": "2026-04-15T12:00:00Z",
  "fingerprint": "example",
  "id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
  "label": "example",
  "last_used_at": "2026-04-15T12:00:00Z",
  "organization_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
  "revoked_at": "2026-04-15T12:00:00Z",
  "scopes": [
    "example"
  ],
  "token": "example",
  "workspace_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0"
}

403

Section titled “403”

Only an instance-level token with tokens:write may mint one

Media typeapplication/json

The canonical JSON body of every error response — the single source of truth the frontend binds to. Every AppError serializes as this exact shape, and the generated OpenAPI component ApiErrorBody (with its ErrorCode enum) is what the frontend error schema is generated from, so there is no hand-written error schema on either end.

object
code
required

Machine-readable, stable error code.

string
Allowed values: not_found unauthorized forbidden license_required license_expired bad_request unprocessable precondition_failed conflict method_not_allowed rate_limited too_many_requests quota_exceeded database_error docker_error vault_error internal_error
details
One of:
null
error
required

Human-readable message (the server’s English text; the client may localize by code).

string
Example
{
  "code": "not_found"
}

422

Section titled “422”

A scope outside management:runners:{read,write,*}

Media typeapplication/json

The canonical JSON body of every error response — the single source of truth the frontend binds to. Every AppError serializes as this exact shape, and the generated OpenAPI component ApiErrorBody (with its ErrorCode enum) is what the frontend error schema is generated from, so there is no hand-written error schema on either end.

object
code
required

Machine-readable, stable error code.

string
Allowed values: not_found unauthorized forbidden license_required license_expired bad_request unprocessable precondition_failed conflict method_not_allowed rate_limited too_many_requests quota_exceeded database_error docker_error vault_error internal_error
details
One of:
null
error
required

Human-readable message (the server’s English text; the client may localize by code).

string
Example
{
  "code": "not_found"
}