Skip to main content
POST
Create an API token

Authorizations

Authorization
string
header
required

Personal Access Token. Send as Authorization: Bearer hq_pat_....

Body

application/json
name
string
required
expires_in_days
integer<int64> | null

Optional expiry; omitted = non-expiring manual PAT.

scopes
string[] | null

Requested capability scopes (resource:action, e.g. documents:read). Omitted = ["user"] (full non-admin access, back-compat). Each must be a known capability scope or a legacy tier; the effective set is still clamped to the caller's role at request time.

Response

The new token (plaintext shown once)

id
string<uuid>
required
name
string
required
scopes
string[]
required
token
string
required

The plaintext token - shown exactly once, never retrievable again.

expires_at
string | null