Create API token

post

https://zyins.isaapi.com/v1/tokens

Issues a new bearer credential with the requested scopes and expiry. The secret value is returned exactly once in the 201 response body — store it immediately in a secret manager, because it cannot be retrieved later. Service-token callers must supply account_id to identify which account to mint under.

Recent Requests

Time	Status	User Agent
Retrieving recent requests…

Loading…

Body Params

account_id

string

Target account when minting via the ServiceToken security option
(required in that mode). For bearer- or license-authenticated callers,
omit or set to the caller's own account; any other value yields 403.

name

string

required

Human-readable label for the token

scopes

array of strings

required

Permission scopes granted to this token

scopes*

expires_in_days

integer

≥ 1

Number of days until the token expires. Omit for non-expiring tokens.

Headers

Idempotency-Key

string

Client-supplied idempotency token for mutating versioned API requests
(POST, PUT, PATCH, DELETE under /v1/* and /v2/* where listed).

When the service has already completed a request for the same
account, route, key, and identical JSON body within the replay window,
it returns the stored HTTP status and body instead of executing again.

Reusing the same key with a different body returns 409 Conflict
(see 409 / Idempotency conflict responses on those operations). Keys
expire after 24 hours. Prefer a new UUID v4 per distinct logical operation.

string

enum

Defaults to application/json

Generated from available response content types

Allowed:

Responses

201Token created successfully

400Invalid request parameters

401Authentication required or invalid

403Insufficient permissions

404Resource not found

409Idempotency key reused with a different request body than the completed replay entry for the same account, endpoint, and key.

429Rate limit exceeded

500Internal server error