Create access token
Creates a new API key with the specified name, description, expiration, and permissions.
Prerequisite: Authentication must be enabled before calling this endpoint. Call PATCH /auth/enabled with {"enabled": true} using an admin JWT first. If auth_enabled is false, the server rejects this request with 403 Forbidden and the message "API key management API requires auth_enabled=true".
Permission model
Access token permissions use a bitmask model.
| Name | Value | Meaning |
|---|---|---|
| read | 1 | Read access |
| write | 2 | Write access |
| admin | 4 | Admin access |
admin is an independent permission bit. It does not automatically grant read or write.
Common combinations:
| Bitmask | Permission string | Meaning |
|---|---|---|
| 1 | read | Read only |
| 2 | write | Write only |
| 4 | admin | Admin only |
| 5 | read,admin | Read and admin |
| 6 | write,admin | Write and admin |
| 7 | read,write,admin | Read, write, and admin |
The create-token API accepts the canonical comma-separated permission names, and the server stores them as the corresponding bitmask.
When using an admin JWT, the server uses the persisted JWT secret from server_params.btr. If ACTIAN_VECTORAI_JWT_SECRET is set at startup, that value overrides the persisted secret and is saved for subsequent restarts.
Headers
Admin JWT or admin access token. Format Bearer <admin-jwt-or-access-token>.
Request body
Example request
{
"permission": "read,admin"
}Response
Token created successfully.