Skip to main content
POST
CreateTokenAPI mints a new API token for the caller. The raw token is returned

Authorizations

Authorization
string
header
required

An Erdo API key (erdo_api_...) or scoped token (erdo_token_...).

Body

application/json
capabilities
string[]

one of these capability strings, and every unmapped endpoint is denied (fail closed). The vocabulary is closed — see the API docs; unknown strings are rejected. Empty mints a normal unscoped key. Scoped keys can never mint tokens, touch managed-organization surfaces, or connect/delete integrations, regardless of the capabilities granted here.

expires_in_days
integer<int64>

0 defaults to 30 days — the REST surface intentionally does not expose no-expiry tokens to prevent callers accidentally minting eternal credentials with a minimal payload like {"name": "ci"}.

name
string
organization_id
string

to the caller's currently-active org. Must be an org the caller belongs to. For scoped keys (capabilities non-empty) this org is a HARD pin: the key can never select another org via X-Organization-ID.

resource_slugs
string[]

workstream calls to these slugs (requires capabilities). Empty = no slug confinement beyond capabilities.

Response

Success response

capabilities
string[]

(absent for unscoped keys).

default_org
object
expires_at
string
hint
string
id
string
resource_slugs
string[]
token
string