Create a workspace access token

POST/api/orgs/{org}/tokens

createOrgToken

Session-authenticated caller only. Mints a credential-less service account and issues an `nso_` token resource-locked to this org. Admin/Owner + sudo, unless the caller has no step-up credential (no password, enabled TOTP, or passkey) and therefore cannot acquire sudo. Once a step-up credential exists, normal sudo is required. The raw token is returned once.

Requires authentication using a session cookie — see tokens and scopes.

curl

curl -X POST 'https://neosource.dev/api/orgs/ORG/tokens' \
  -b 'ns_session=$NEOSOURCE_SESSION' \
  -H 'Content-Type: application/json' \
  -d '{"label":"string"}'

fetch

fetch("https://neosource.dev/api/orgs/ORG/tokens", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({"label":"string"}),
});

Path parameters

orgrequired: Organization slug.
string

Request bodyrequired

application/json

CreateOrgTokenRequest

object

expires_in_days: integer | nullint32
Lifetime in days (default 90, max 400).
labelrequired: string
Human label; also folded into the service-account handle.
role: one of
null
WorkspaceRole
string
Workspace membership role. Ordered low → high (`Member < Admin < Owner`) so that `if actor_role >= WorkspaceRole::Admin` reads naturally.
"member""admin""owner"
scopes: array
Scope grant (validated against the grantable catalog). Empty ⇒ the default org grant (`workspace:read` + `repo:*`).
items
string

additional propertiesnot allowed

Responses

201Token created

application/json

CreateOrgTokenResponse

object

Create response — like [`OrgTokenResponse`] but carrying the one-time raw secret.

expires_at: integer | nullint64
labelrequired: string
raw_tokenrequired: string
rolerequired: WorkspaceRole
string
Workspace membership role. Ordered low → high (`Member < Admin < Owner`) so that `if actor_role >= WorkspaceRole::Admin` reads naturally.
"member""admin""owner"
scopesrequired: array
items
string
service_account_handlerequired: string
token_idrequired: string

403Forbidden — one of: forbidden, sudo_required

application/json

one of

ErrorForbidden
SudoRequiredError
object
Wire shape of the 403 a sudo-gated endpoint returns when sudo is missing or expired. `challenge` tells the SPA which sudo-prove endpoint to call.
challengerequired
string
Which sudo-prove endpoint the account should use: `"passkey"` (`/api/auth/sudo/passkey/{start,finish}`), `"password"` (`/api/auth/sudo/password`), or `"totp"` (`/api/auth/sudo/totp`), chosen from the account's registered credentials — passkey first when present, since it is both the strongest credential and the least friction. A hint for which prompt to show first, not an authorization decision: each sudo route verifies its own credential regardless of what was advertised here, so a client may use a different one.
errorrequired
string
Always `sudo_required` — this body exists to carry the extra fields that kind needs.
"sudo_required"
messagerequired
string

Standard errors

Bodies documented once for the whole API — see standard errors.

400Bad Request — one of: invalid_input
401Authentication required
404Not Found — one of: not_found
409Conflict — one of: already_exists, conflict
429Rate limited — retry after the `Retry-After` header
500Internal server error
503Service temporarily unavailable / at capacity — retry after the `Retry-After` header
504Gateway timeout — the request exceeded the server's handling budget