POST /api/v1/auth/service-token

Status: GA Access: token required API contract: 0.3.0 · capability 2026-09-03.1 View as Markdown Open in Claude Open in ChatGPT

Mint Service Token

Mint (or rotate) a long-lived READ-ONLY access token for an external agent.

Superuser-only. The endpoint can only create/serve users with read-only agent scope — it is structurally unable to hand out full-access tokens. Re-minting reactivates a previously revoked user.

Auth: Authorization: Bearer <token> required

Request

curl -sS -X POST "https://entherium.duckdns.org:8443/api/v1/auth/service-token" \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{"email":"<email>","expires_days":"<expires_days>","full_name":"<full_name>","revoke_prior":"<revoke_prior>"}'

Response `200`

{
  "access_token": "eyJhbGciOiJIUzI1NiJ9.<payload>.<signature>",
  "api_scope": "agent",
  "email": "agent@entherium.dev",
  "expires_in": 7776000,
  "token_type": "bearer",
  "user_guid": 5
}

Returns

ServiceTokenResponse — Successful Response

Field	Type	Description
`access_token`	`string`
`api_scope`	`string`
`email`	`string`
`expires_in`	`integer`
`token_type`	`string` (opt.)
`user_guid`	`integer`

Parameters

Parameter	In	Required	Type	Default	Constraints	Description
`Idempotency-Key`	header	no	`string`	—	uuid	Optional.

Request body

Field	Type	Required
`email`	`string`	no
`expires_days`	`integer`	no
`full_name`	`string \| null`	no
`revoke_prior`	`boolean`	no

Errors

Code	Meaning	Body
`401`	Missing or invalid authentication credentials	`ErrorResponse`
`409`	The e-mail belongs to an existing non-read-only user; refusing to convert	`ErrorResponse`
`422`	Validation Error	`HTTPValidationError`

Every error body is {detail, code?, request_id, doc_url} — request_id is the value to quote, doc_url points at the Errors reference.