Generate a new API key
Creates a new API key with the specified permissions. The full key secret is only returned once in this response - store it securely. Personal access tokens always expire: `expirationDays` is required, from 1 to 365.
Authorization
Bearer JWT Authorization header using the Bearer scheme. Enter 'Bearer' [space] and then your token.
In: header
Path Parameters
The tenant identifier
The API key configuration
Gets or sets the name of the API key. This helps in identifying the purpose of the key.
Number of days until the token expires. Required: from 1 to 365 (PersonalTokenLifetime.MaxDays). Personal access tokens cannot be minted without an expiry; omitting it, or asking for more than 365 days, is a 400.
int32Explicit scope list. Each entry must be a known scope from TokenScopes.AllScopes; unknown values cause the request to 400 with the offending strings listed. Combined (unioned) with the expansion of GenerateTokenRequest.Preset when both are supplied — that lets callers say "the runner preset plus one extra scope I need" without having to enumerate the whole preset by hand.
Named preset (sugar for a scope list). One of runner,
builder, read-only, admin. Expanded at
mint time; the preset name itself is never stored — only the
expanded scope array — so a preset definition change tomorrow
doesn't retroactively widen permissions on keys minted today.
Stable per-install device id to stamp on the minted token, for CLI-auth keys (see Token.DeviceId). Lets a later re-login from the same machine rotate this credential in place. Null for everything else.
Response Body
curl -X POST "https://api.fruxon.com/v1/tenants/string/tokens:generate" \ -H "Content-Type: application/json" \ -d '{}'{
"id": "00000000-0000-0000-0000-000000000000",
"name": "string",
"token": "string",
"keyPrefix": "string",
"scopes": [
"string"
],
"droppedScopes": [
"string"
],
"createdAt": 0,
"expiresAt": 0,
"createdBy": "string"
}{
"type": "string",
"title": "string",
"status": 0,
"detail": "string",
"instance": "string",
"property1": null,
"property2": null
}{
"type": "string",
"title": "string",
"status": 0,
"detail": "string",
"instance": "string",
"property1": null,
"property2": null
}Revoke a token
Permanently revokes a token — terminal and irreversible. Any request using it immediately starts returning 401. The row is retained so the audit and request-activity history survive. To temporarily suspend access, suspend the owning principal (e.g. the service account) instead — a token cannot be paused and re-enabled.
Rotate an API key
Mints a replacement key that inherits the original's scopes, name, and type by default, then revokes the original. Pass optional overrides in the request body to narrow / widen scopes, rename the key, or change its lifetime in the same call — fields you omit inherit from the original. Inherited scopes that have since been retired from the platform are dropped and listed under `droppedScopes` in the response; they granted nothing by then, so this is a cleanup rather than a narrowing. Scopes you pass explicitly are validated as on a fresh mint — an unknown one is a 400. Omit `expirationDays` to renew for the lifetime the key was last granted, at mint or by the latest rotate that chose one, capped at 365 days (a token that never expired gets 365); pass it to choose 1 to 365 days. There is no "never expire". The full key secret of the new key is only returned once in this response — store it securely and update wherever the old key was wired.