---
title: "access tokens batch"
method: POST
path: "/users/access-tokens/batch"
tags: ["Users"]
---

# access tokens batch

`POST /users/access-tokens/batch`

Generates short-lived access tokens for up to 1,000 active non-admin users in a single request. Requires ORG_ADMIN or campaign API-key access. The server always sets context to 'public_api_bulk'; callers may not supply their own context. Duplicate UUIDs in the input are deduplicated (first occurrence wins). Results are returned in the same order as the deduplicated input array, with per-user error codes for any user that could not be issued a token.
#### For custom components:
`RaiselyComponents.api.all('users').all('access-tokens').all('batch').post(data = {}, params = {}, headers = {}) => Promise<{result}>`

 :fa-gears: See [Restie Response Data](https://github.com/raisely/restie#reading-and-handling-responses) for a more detailed overview of responses through the client wrapper

## Headers

- `Authorization` string

## Request body

- object
  - `data` object
    - `userUuids` string[], required — Array of user UUIDs to generate tokens for. Must be 1–1000 entries; all entries must be valid UUIDs. Duplicates are silently deduplicated (first occurrence wins) — the results array and summary.total reflect the deduplicated count.
    - `redirectTo` string — Optional relative path to redirect to after each access token is consumed.

## Response `200`

Batch token generation result. Each entry in results corresponds to one deduplicated UUID in the same order. A request can partially succeed — check each entry's error field.

- object
  - `data` object
    - `results` object[]
      - `userUuid` string, uuid
      - `accessToken` string — The generated access token (UUID format). Present only on success.
      - `expiresAt` string, date-time — Token expiration timestamp based on the organisation's configured access-token expiry policy (default 48 hours). Present only on success.
      - `error` object — Present only when token issuance failed for this user.
        - `code` 'user_not_found' | 'user_is_admin'
    - `summary` object
      - `succeeded` integer
      - `failed` integer
      - `total` integer — Total number of deduplicated UUIDs processed.

## Other responses

- `400` — Invalid request body. Possible subcodes: empty_batch (userUuids is empty or missing), batch_too_large (more than 1000 entries), invalid_uuid (a non-UUID value in userUuids), context_not_allowed (caller supplied data.context)
- `401` — Authorization credentials were missing or invalid
- `403` — The user is authenticated, but is not allowed to perform the requested operation
- `404` — Access token generation is not enabled for this organisation
- `410` — The requested record no longer exists, or that API has been deprecated
- `429` — You have made too many requests to the given endpoint, please try again later
- `500` — An unexpected error has occurred with Raisely. If the error persists you can contact support@raisely.com

---

[API](https://skmtc.net/raisely/apis/raisely-api.md) · [All operations](https://skmtc.net/raisely/apis/raisely-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/raisely/raisely-api/revisions/d7f8dd294cb0/schema)