POST /api/v1/auth/agent-token

Status: GA Access: token required API contract: 0.3.0 · capability 2026-09-03.1 View as Markdown Open in Claude Open in ChatGPT

Mint Agent Token

mint (or rotate) a scoped AGENT token + its contract grants.

Superuser-only. Creates (or reuses) the agent identity and REPLACES its grant pool with body.grants (default-deny — a contract not listed is inaccessible). Changing the pool or capabilities later is a grant edit, no re-mint needed. publish is granted only when listed explicitly: withhold on prod contracts by default).

Auth: Authorization: Bearer <token> required

Request

curl -sS -X POST "https://entherium.duckdns.org:8443/api/v1/auth/agent-token" \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{"email":"agent@entherium.dev","expires_days":90,"full_name":"Partner agent","grants":[{"capabilities":["submit","launch","cancel","edit_config"],"salescontract":40}],"revoke_prior":true}'

Response `200`

{
  "access_token": "eyJhbGciOiJIUzI1NiJ9.<payload>.<signature>",
  "api_scope": "agent",
  "email": "agent@entherium.dev",
  "expires_in": 7776000,
  "token_type": "bearer",
  "user_guid": 5
}

Returns

ServiceTokenResponse — Successful Response

Field	Type	Description
`access_token`	`string`
`api_scope`	`string`
`email`	`string`
`expires_in`	`integer`
`token_type`	`string` (opt.)
`user_guid`	`integer`

Parameters

Parameter	In	Required	Type	Default	Constraints	Description
`Idempotency-Key`	header	no	`string`	—	uuid	Optional.

Request body

Field	Type	Required
`email`	`string`	no
`expires_days`	`integer`	no
`full_name`	`string \| null`	no
`grants`	`array of AgentGrantSpec`	yes
`revoke_prior`	`boolean`	no

Example:

{
  "email": "agent@entherium.dev",
  "expires_days": 90,
  "full_name": "Partner agent",
  "grants": [
    {
      "capabilities": [
        "submit",
        "launch",
        "cancel",
        "edit_config"
      ],
      "salescontract": 40
    }
  ],
  "revoke_prior": true
}

Errors

Code	Meaning	Body
`401`	Missing or invalid authentication credentials	`ErrorResponse`
`409`	The e-mail belongs to a non-agent user; refusing to convert	`ErrorResponse`
`422`	Validation Error	`HTTPValidationError`

Every error body is {detail, code?, request_id, doc_url} — request_id is the value to quote, doc_url points at the Errors reference.