Skip to main content
POST
Error

Authorizations

Authorization
string
header
required

API token obtained from the Tokens endpoint or CLI device login. Include as Authorization: Bearer <token>. Requests made with a managed CLI session also include X-Strix-Workspace: <organization_id> to pin a process to the workspace it started in; recovery endpoints report the current workspace after a concurrent switch.

Body

application/json
type
enum<string>
required

Token kind. service tokens belong to the organization, personal tokens act as the creating user.

Available options:
service,
personal
name
string
required

Display name that identifies the token in the dashboard.

scopes
enum<string>[]

When omitted or empty, service keys default to scans:read, scans:write, vulnerabilities:read, vulnerabilities:write, schedules:read, schedules:write, assets:read, webhooks:read, and webhooks:write. Personal keys default to the same first seven scopes without either webhook scope. Defaults and explicit requests are capped by the creator's current organization role; token-authenticated creators are additionally capped by the caller token's API and RBAC scopes. Only organization admins can create service keys.

Available options:
scans:read,
scans:write,
vulnerabilities:read,
vulnerabilities:write,
dependencies:read,
schedules:read,
schedules:write,
assets:read,
assets:write,
organizations:read,
organizations:write,
members:read,
members:write,
invitations:read,
invitations:write,
webhooks:read,
webhooks:write,
tokens:write,
audit:read,
pr_reviews:read,
pr_reviews:write,
connectors:read,
connectors:write,
knowledge:read,
knowledge:write,
uploads:write,
integrations:read,
integrations:write,
chat:read,
chat:write,
scans:message,
analytics:read,
llm:read,
llm:write,
test_users:read,
test_users:write,
license:read,
supply_chain:read,
supply_chain:write,
billing:read,
billing:write
rbac_scopes
object[]

Optional Enterprise RBAC asset restrictions. When omitted, a token-authenticated creator's restrictions are inherited; a browser-session creator defaults to an empty array (organization-wide asset access within the token's API scopes and role). Explicit restrictions must be a subset of the caller token's RBAC scopes.

expires_at
string<date-time>

Explicit expiration. Mutually exclusive with expires_in_days.

expires_in_days
integer

Expiration as days from now. Personal tokens default to 90 days.

Required range: x >= 1

Response

Token created. The token field contains the raw secret — store it securely.

token
string
required

Raw API token secret. Only returned at creation time.

token_record
object
required