Create an API token
Create a new service or personal API token. The raw token secret is returned only in this response. Asset-scoped tokens cannot access organization-wide token management.
Authorizations
API token obtained from the Tokens endpoint or CLI device login. Include as Authorization: Bearer <token>. Requests made with a managed CLI session also include X-Strix-Workspace: <organization_id> to pin a process to the workspace it started in; recovery endpoints report the current workspace after a concurrent switch.
Body
Token kind. service tokens belong to the organization, personal tokens act as the creating user.
service, personal Display name that identifies the token in the dashboard.
When omitted or empty, service keys default to scans:read, scans:write, vulnerabilities:read, vulnerabilities:write, schedules:read, schedules:write, assets:read, webhooks:read, and webhooks:write. Personal keys default to the same first seven scopes without either webhook scope. Defaults and explicit requests are capped by the creator's current organization role; token-authenticated creators are additionally capped by the caller token's API and RBAC scopes. Only organization admins can create service keys.
scans:read, scans:write, vulnerabilities:read, vulnerabilities:write, dependencies:read, schedules:read, schedules:write, assets:read, assets:write, organizations:read, organizations:write, members:read, members:write, invitations:read, invitations:write, webhooks:read, webhooks:write, tokens:write, audit:read, pr_reviews:read, pr_reviews:write, connectors:read, connectors:write, knowledge:read, knowledge:write, uploads:write, integrations:read, integrations:write, chat:read, chat:write, scans:message, analytics:read, llm:read, llm:write, test_users:read, test_users:write, license:read, supply_chain:read, supply_chain:write, billing:read, billing:write Optional Enterprise RBAC asset restrictions. When omitted, a token-authenticated creator's restrictions are inherited; a browser-session creator defaults to an empty array (organization-wide asset access within the token's API scopes and role). Explicit restrictions must be a subset of the caller token's RBAC scopes.
Explicit expiration. Mutually exclusive with expires_in_days.
Expiration as days from now. Personal tokens default to 90 days.
x >= 1