Skip to content
SupaCloud Docs
Select themeSelect language

`POST /api/workspaces/{id}/api-tokens` — mint a workspace-scoped token (owner/admin). The response carries the plaintext exactly once. Audited (`api_token.mint`).

POST
/api/workspaces/{id}/api-tokens
curl --request POST \
  --url https://example.com/api/workspaces/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/api-tokens \
  --header 'Content-Type: application/json' \
  --cookie supacloud_session=<supacloud_session> \
  --data '{ "expires_at": "2026-04-15T12:00:00Z", "label": "example", "scopes": [ "example" ] }'

Authorizations

Section titled “Authorizations”

Parameters

Section titled “Parameters”

Path Parameters

Section titled “Path Parameters”
id
required
string format: uuid

Workspace ID

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json

Request body to mint a workspace API token. scopes is required and limited to the self-service set (mcp:read, mcp:ops, management:read).

object
expires_at

Optional expiry; must lie in the future.

string | null format: date-time
label
required

Human-readable label (shown in the token list).

string
scopes
required

The granted scopes — required, non-empty.

Array<string>
Examplegenerated
{
  "expires_at": "2026-04-15T12:00:00Z",
  "label": "example",
  "scopes": [
    "example"
  ]
}

Responses

Section titled “Responses”

200

Section titled “200”

The minted token (plaintext shown once)

Media typeapplication/json

One workspace API token. token (the scmt_ plaintext) is present ONLY on the mint response — a list never carries it.

object
created_at
required
string format: date-time
expires_at
string | null format: date-time
fingerprint
required

The public correlation handle (also the revoke path parameter).

string
id
required
string format: uuid
label
required
string
last_used_at
string | null format: date-time
revoked_at
string | null format: date-time
scopes
required
Array<string>
token

The plaintext bearer — mint response only, shown exactly once.

string | null
Examplegenerated
{
  "created_at": "2026-04-15T12:00:00Z",
  "expires_at": "2026-04-15T12:00:00Z",
  "fingerprint": "example",
  "id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
  "label": "example",
  "last_used_at": "2026-04-15T12:00:00Z",
  "revoked_at": "2026-04-15T12:00:00Z",
  "scopes": [
    "example"
  ],
  "token": "example"
}

400

Section titled “400”

Missing label / empty or non-mintable scopes / past expiry

Media typeapplication/json

The canonical JSON body of every error response — the single source of truth the frontend binds to. Every AppError serializes as this exact shape, and the generated OpenAPI component ApiErrorBody (with its ErrorCode enum) is what the frontend error schema is generated from, so there is no hand-written error schema on either end.

object
code
required

Machine-readable, stable error code.

string
Allowed values: not_found unauthorized forbidden license_required license_expired bad_request unprocessable precondition_failed conflict method_not_allowed rate_limited too_many_requests quota_exceeded database_error docker_error vault_error internal_error
details
One of:
null
error
required

Human-readable message (the server’s English text; the client may localize by code).

string
Example
{
  "code": "not_found"
}

401

Section titled “401”

Authentication required

Media typeapplication/json

The canonical JSON body of every error response — the single source of truth the frontend binds to. Every AppError serializes as this exact shape, and the generated OpenAPI component ApiErrorBody (with its ErrorCode enum) is what the frontend error schema is generated from, so there is no hand-written error schema on either end.

object
code
required

Machine-readable, stable error code.

string
Allowed values: not_found unauthorized forbidden license_required license_expired bad_request unprocessable precondition_failed conflict method_not_allowed rate_limited too_many_requests quota_exceeded database_error docker_error vault_error internal_error
details
One of:
null
error
required

Human-readable message (the server’s English text; the client may localize by code).

string
Example
{
  "code": "not_found"
}

403

Section titled “403”

Permission denied

Media typeapplication/json

The canonical JSON body of every error response — the single source of truth the frontend binds to. Every AppError serializes as this exact shape, and the generated OpenAPI component ApiErrorBody (with its ErrorCode enum) is what the frontend error schema is generated from, so there is no hand-written error schema on either end.

object
code
required

Machine-readable, stable error code.

string
Allowed values: not_found unauthorized forbidden license_required license_expired bad_request unprocessable precondition_failed conflict method_not_allowed rate_limited too_many_requests quota_exceeded database_error docker_error vault_error internal_error
details
One of:
null
error
required

Human-readable message (the server’s English text; the client may localize by code).

string
Example
{
  "code": "not_found"
}

500

Section titled “500”

Structured server error

Media typeapplication/json

The canonical JSON body of every error response — the single source of truth the frontend binds to. Every AppError serializes as this exact shape, and the generated OpenAPI component ApiErrorBody (with its ErrorCode enum) is what the frontend error schema is generated from, so there is no hand-written error schema on either end.

object
code
required

Machine-readable, stable error code.

string
Allowed values: not_found unauthorized forbidden license_required license_expired bad_request unprocessable precondition_failed conflict method_not_allowed rate_limited too_many_requests quota_exceeded database_error docker_error vault_error internal_error
details
One of:
null
error
required

Human-readable message (the server’s English text; the client may localize by code).

string
Example
{
  "code": "not_found"
}