Create an API token

POST /tokens

Auth Console session Role Owner or Manager

Create a token with the given scopes. The response carries tokenValue, the secret, exactly once: store it in a secret manager, it cannot be shown again. Scopes are explicit catalogue names (GET /tokens/scopes lists them, with who may grant each and whether an expiry is required); a wildcard, a bundle name or an unknown scope is refused with SCOPE_INVALID. Some scopes are limited to an Owner (OWNER_REQUIRED), need an active membership (MEMBERSHIP_REQUIRED) or a sufficient role (INSUFFICIENT_ROLE), and some require an expiry within a maximum lifetime (EXPIRY_REQUIRED, EXPIRY_TOO_LONG): pii:read needs an Owner and expires within 90 days; jml:read expires within 365 days; supplier_template:write needs an expiry. A token cannot be created or revoked from a support session (SUPPORT_SESSION_NO_MINT). At most 20 tokens per organization. Requires a console session of an Owner or Manager.

curl -X POST "https://api.autociso.io/api/v1/tokens" \
  -H "Authorization: Bearer <console-session-token>" \
  -H "Content-Type: application/json" \
  -d '{"name":"GitHub Actions SBOM upload","scopes":["sbom:write"]}'

import requests

response = requests.post(
    "https://api.autociso.io/api/v1/tokens",
    headers={"Authorization": "Bearer <console-session-token>", "Content-Type": "application/json"},
    json={
        "name": "GitHub Actions SBOM upload",
        "scopes": [
            "sbom:write",
        ],
    },
)
print(response.json())

const response = await fetch("https://api.autociso.io/api/v1/tokens", {
  method: "POST",
  headers: { "Authorization": "Bearer <console-session-token>", "Content-Type": "application/json" },
  body: JSON.stringify({
    "name": "GitHub Actions SBOM upload",
    "scopes": [
      "sbom:write"
    ]
  }),
});
console.log(await response.json());

{
  "data": {
    "tokenId": "tok_1hgz7c0aw2mf",
    "name": "GitHub Actions SBOM upload",
    "prefix": "aci_XXXX",
    "scopes": [
      "sbom:write"
    ],
    "createdBy": "usr_1hgyq2mw7c3k",
    "createdAt": "2026-10-09T09:00:00Z",
    "updatedAt": "2026-10-09T09:00:00Z",
    "tokenValue": "aci_<redacted>"
  }
}