createPersonalAccessToken

POST

/api/v1/me/security/pats

curl --request POST \
  --url https://example.com/api/v1/me/security/pats \
  --header 'Content-Type: application/json' \
  --cookie tilecast_session=<tilecast_session> \
  --data '{ "name": "example", "scopes": [ "read" ], "expiresInDays": 7 }'

Requires an authenticated user with the admin scope. Cookie requests additionally require the X-CSRF-Token header. Creates a named personal access token with a fixed lifetime of 7, 30, 90, or 365 days; there is no permanent token. The plaintext secret (tcp_ prefix) is returned exactly once in this response and is never shown or listed again. Only SHA-256 hashes are stored.

Authorizations

• sessionCookie
• userBearer

Parameters

Header Parameters

X-CSRF-Token

string

Cookie-backed browser requests only, and only on unsafe methods. Bearer grants never send it.

Request Body^required

Media typeapplication/json

object

name

required

string

<= 100 characters

scopes

required

Array<string>

Allowed values: read write admin

expiresInDays

required

integer

Allowed values: 7 30 90 365

Responses

201

PAT created with one-time secret

Media typeapplication/json

object

data

required

object

token

required

Plaintext secret returned exactly once; never listed again.

string

pat

required

object

id

required

string format: uuid

name

required

string

scopes

required

Array<string>

Allowed values: read write admin

createdAt

required

string format: date-time

expiresAt

required

string format: date-time

lastUsedAt

required

string | null format: date-time

revokedAt

required

string | null format: date-time

Example

{
  "data": {
    "pat": {
      "scopes": [
        "read"
      ]
    }
  }
}

400

Invalid name, scopes, or lifetime

401

Dashboard authentication required

403

CSRF token required