---
title: "Auth Jwt Scope Create"
method: POST
path: "/auth/jwt/scope/"
tags: ["authentication"]
---

# Auth Jwt Scope Create

`POST /auth/jwt/scope/`

Step-up scope change — Phase 5 of the staff step-up auth rollout.

One endpoint, both directions. Caller submits the desired
``session_scope`` value; the server validates, mints a new JWT
carrying that scope, and returns it. Models OAuth 2.0 Token
Exchange (RFC 8693). Replaces the originally-planned two
endpoints (/scope-up/ + /scope-down/) — they were the same
operation with opposite signs.

Validation gates differ by direction:
  - Elevating (non-empty scope): requires ``reason`` in the body
    AND a fresh ``is_password_recently_verified`` flag (from the
    Phase 4 password-verify endpoint, 5-min sudo window).
  - Narrowing (empty scope): no extra gate. Narrowing is always
    safe and reversible.

The OLD JWT remains cryptographically valid until its ``exp``.
Caller is responsible for replacing it client-side. Instant
invalidation comes in Phase 7 (JTI denylist).

See implementation_logs/security/staff_step_up_auth_design.md §5.

## Headers

- `Authorization` string, required

## Response `200`

No response body

- AuthenticationAuthJwtScopeCreateResponse200 — Empty response body

---

[API](https://skmtc.net/keywordsai/apis/api-reference.md) · [All operations](https://skmtc.net/keywordsai/apis/api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/keywordsai/api-reference/versions/c26d550029f8/schema)