Tokens
Mint a grp_at_ read-only token pinned to this workspace. The plaintext token is returned once and never again. Tokens are mint/revoke-only — there is no list endpoint.
Authorization
bearerAuth HTTP bearer credential in the Authorization header. Two planes share the
scheme, distinguished by prefix:
grp_sk_…— a management key: full control of the account (workspaces, files, token minting, audit export) plus the read tools.grp_at_…— a scoped read-only token: minted per workspace, it may call only the read tools (ls/find/cat/grep) and is rejected by every management route.
In: header
Path Parameters
Workspace name. Workspace name must be 1-64 lowercase letters, digits, hyphens, or underscores, starting and ending with a letter or digit.
^[a-z0-9](?:[a-z0-9_-]{0,62}[a-z0-9])?$Request Body
application/json
Optional claims (visibility scope, default ["*"]) and TTL in seconds (60–86400, default 3600).
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/v1/workspaces/string/tokens" \ -H "Content-Type: application/json" \ -d '{}'{ "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "token": "string", "claims": [ "string" ], "expiresAt": "string"}Authorization
bearerAuth HTTP bearer credential in the Authorization header. Two planes share the
scheme, distinguished by prefix:
grp_sk_…— a management key: full control of the account (workspaces, files, token minting, audit export) plus the read tools.grp_at_…— a scoped read-only token: minted per workspace, it may call only the read tools (ls/find/cat/grep) and is rejected by every management route.
In: header
Path Parameters
The token id (uuid) returned when the token was minted.
uuidResponse Body
application/json
application/json
application/json
curl -X DELETE "https://example.com/v1/tokens/497f6eca-6276-4993-bfeb-53cbbbba6f08"