Skip to main content
POST
Error

Authorizations

Authorization
string
header
required

API token obtained from the Tokens endpoint. Include as Authorization: Bearer <token>.

Body

application/json
type
enum<string>
required
Available options:
service,
personal
name
string
required
scopes
enum<string>[]

Defaults to a sensible set if omitted.

Available options:
scans:read,
scans:write,
vulnerabilities:read,
vulnerabilities:write,
dependencies:read,
schedules:read,
schedules:write,
assets:read,
assets:write,
organizations:read,
organizations:write,
members:read,
members:write,
invitations:read,
invitations:write,
webhooks:read,
webhooks:write,
tokens:write,
audit:read,
pr_reviews:read,
pr_reviews:write,
connectors:read,
connectors:write,
knowledge:read,
knowledge:write,
uploads:write,
integrations:read,
integrations:write,
chat:read,
chat:write,
scans:message,
analytics:read,
test_users:read,
test_users:write
expires_at
string<date-time>

Explicit expiration. Mutually exclusive with expires_in_days.

expires_in_days
integer

Expiration as days from now. Personal tokens default to 90 days.

Required range: x >= 1

Response

Token created. The token field contains the raw secret — store it securely.

token
string
required

Raw API token secret. Only returned at creation time.

token_record
object
required