Mint an API token

POST

/orgs/{org}/tokens

curl --request POST \
  --url https://api.sloose.com/orgs/org_9f3c/tokens \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "name": "CI — config push", "expiresAt": "2026-04-15T12:00:00Z" }'

• Production
• Staging

Creates a token scoped to this org with the admin role, acting as the member who created it. The secret is in the response and nowhere else, so store it when you receive it.

Session only. An org API token is refused here with 403 SESSION_REQUIRED: a token must not be able to mint or revoke tokens.

Authorizations

• sessionAuth

Parameters

Path Parameters

org

required

The org id the session was issued for. A token for one org can never read another.

string

Example

org_9f3c

The org id the session was issued for. A token for one org can never read another.

Request Body^required

Media typeapplication/json

object

name

required

What the token is for. Shown in the token list.

string

>= 1 characters <= 80 characters

Example

CI — config push

expiresAt

ISO timestamp. Omitted means the token never expires.

string format: date-time

Responses

201

Created. secret is not retrievable afterwards.

Media typeapplication/json

object

token

required

object

id

required

string

name

required

string

prefix

required

The token’s leading characters, for recognising it in a list.

string

role

required

string

createdByUserId

required

string

createdAt

required

string

expiresAt

required

string | null

secret

required

Shown once. The server keeps only a hash of it.

string

Example

{
  "secret": "slo_…"
}

400

The request body did not match the schema. issues carries the Zod issue list.

Media typeapplication/json

The error envelope every non-2xx answer uses.

object

error

required

Human-readable explanation.

string

code

Machine-readable reason. Absent on a few legacy 400s.

string

key

additional properties

Example^generated

{
  "error": "example",
  "code": "example"
}

401

You are no longer a member of this org.

Media typeapplication/json

object

error

required

string

code

required

string

Allowed values: MEMBERSHIP_GONE

key

additional properties

Example

{
  "code": "MEMBERSHIP_GONE"
}

403

An API token was used, the role is too low, or the bearer belongs to another org.

Media typeapplication/json

object

error

required

string

code

required

string

Allowed values: SESSION_REQUIRED ROLE_REQUIRED ORG_MISMATCH

key

additional properties

Example

{
  "code": "SESSION_REQUIRED"
}

422

expiresAt is not in the future.

Media typeapplication/json

object

error

required

string

code

required

string

Allowed values: EXPIRY_IN_PAST

key

additional properties

Example

{
  "code": "EXPIRY_IN_PAST"
}