---
title: "POST /authorizationTokens"
method: POST
path: "/authorizationTokens"
tags: ["Tokens"]
---

# POST /authorizationTokens

`POST /authorizationTokens`

Resellers can retrieve access tokens for a given end-user account, assuming that the end-user account falls under the reseller's account.

## Request body

- union
  - ApiApplicationTokenRequest
    - `scopes` string[], required — The sets of scopes the token's authorization should be limited to. Since a user can also have limited permissions, the final set of scopes is the intersection of the user's permissions and the requested scopes. Supported scopes: * `vms.all`: All possible scopes. Currently only `vms.all` is supported.
    - `type` 'application', required
    - `targetId` string, required — Id of the user for which a token should be generated.
    - `targetType` 'user', required
    - `expirationTimestamp` string, date-time — The time at which the token will expire, if it isn't revoked beforehand. Maximum expiration time is 6 months, minimum expiration time is 15 minutes. If not provided, the token expiry time will be set based on account settings.
  - ApiResellerTokenRequest
    - `scopes` string[], required — The sets of scopes the token's authorization should be limited to. Since a user can also have limited permissions, the final set of scopes is the intersection of the user's permissions and the requested scopes. Supported scopes: * `vms.all`: All possible scopes. Currently only `vms.all` is supported.
    - `type` 'reseller', required
    - `targetId` string, required — Id of the account for which a token should be generated.
    - `targetType` 'account', required
  - ApiApplicationToResellerSubAccountTokenRequest
    - `scopes` string[], required — The sets of scopes the token's authorization should be limited to. Since a user can also have limited permissions, the final set of scopes is the intersection of the user's permissions and the requested scopes. Supported scopes: * `vms.all`: All possible scopes. Currently only `vms.all` is supported.
    - `resellerUserId` string, required — Id of the reseller user which is going to be used for "Switching into" an end-user account.
    - `type` 'applicationToResellerSubAccount', required
    - `targetId` string, required — Id of the sub-account for which a token should be generated.
    - `targetType` 'account', required
    - `expirationTimestamp` string, date-time — The time at which the token will expire, if it isn't revoked beforehand. Maximum expiration time is 6 months, minimum expiration time is 15 minutes. If not provided, the token expiry time will be set based on account settings.
  - ApiIdentityTokenRequest
    - `scopes` string[], required — The sets of scopes the token's authorization should be limited to. Since a user can also have limited permissions, the final set of scopes is the intersection of the user's permissions and the requested scopes. Supported scopes: * `vms.all`: All possible scopes. Currently only `vms.all` is supported.
    - `type` 'identity', required
    - `targetId` string, required — Id of the account for which a token should be generated.
    - `targetType` 'account', required

## Response `201`

Token created

- ApiTokenResponse
  - `accessToken` string, required — An OAuth 2.0 access token that authorizes access to protected resources.
  - `refreshToken` string — An OAuth 2.0 refresh token that can be used to request a new access token without requiring the user to reauthenticate. The refresh token may be issued when generating tokens using an identity access token.
  - `expireTimestamp` string, date-time, required — The time at which the token will expire, if it isn't revoked beforehand.
  - `scopes` string[], required
  - `httpsBaseUrl` object — Represents base URL to use to do REST API calls over https. This includes the host and port information.
    - `hostname` string, required — Host to connect to do REST API calls
    - `port` integer, required

## Other responses

- `400` — The supplied object is invalid. Error detail will contain the validation error.
- `401` — You are not authenticated. Please authenticate and try again.
- `403` — You have no permission to access the specified resource.
- `404` — Referenced resource could not be found.
- `500` — Something went wrong in the server. Please try again.

---

[API](https://skmtc.net/eagleeyenetworks/apis/devices.md) · [All operations](https://skmtc.net/eagleeyenetworks/apis/devices/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/eagleeyenetworks/devices/revisions/df57313de545/schema)