CreateTokenAPI mints a new API token for the caller. The raw token is returned
exactly once.
Authorizations
An Erdo API key (erdo_api_...) or scoped token (erdo_token_...).
Body
one of these capability strings, and every unmapped endpoint is denied (fail closed). The vocabulary is closed — see the API docs; unknown strings are rejected. Empty mints a normal unscoped key. Scoped keys can never mint tokens, touch managed-organization surfaces, or connect/delete integrations, regardless of the capabilities granted here.
0 defaults to 30 days — the REST surface intentionally does not expose no-expiry tokens to prevent callers accidentally minting eternal credentials with a minimal payload like {"name": "ci"}.
to the caller's currently-active org. Must be an org the caller belongs to. For scoped keys (capabilities non-empty) this org is a HARD pin: the key can never select another org via X-Organization-ID.
workstream calls to these slugs (requires capabilities). Empty = no slug confinement beyond capabilities.

