Auth_tokensBootstrap

POST

/auth/tokens/bootstrap

const url = 'http://localhost:3000/api/auth/tokens/bootstrap';
const options = {
  method: 'POST',
  headers: {'X-Bootstrap-Token': 'example', 'Content-Type': 'application/json'},
  body: '{"name":"example","scopes":["contacts:read"],"expiresAt":"2026-04-15T12:00:00Z"}'
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request POST \
  --url http://localhost:3000/api/auth/tokens/bootstrap \
  --header 'Content-Type: application/json' \
  --header 'X-Bootstrap-Token: example' \
  --data '{ "name": "example", "scopes": [ "contacts:read" ], "expiresAt": "2026-04-15T12:00:00Z" }'

Authorizations

None

Parameters

Header Parameters

X-Bootstrap-Token

required

string

Request Body^required

application/json

object

name

required

string

scopes

required

Array<string>

Allowed values: contacts:read contacts:write contacts:erase segments:read segments:write events:read events:write broadcasts:read broadcasts:write automations:read automations:write enrollments:read templates:read templates:write webhooks:read webhooks:write webhooks:regenerate webhooks:test custom_fields:read sending_domains:read sending_domains:write integrations:read integrations:write emails:send broadcasts:send automations:activate mcp:send tokens:read tokens:write audit:read export:read

expiresAt

string format: date-time

Responses

201

The request has succeeded and a new resource has been created as a result.

application/json

object

token

required

string

tokenInfo

required

object

required

A primary key, written as a decimal string so JavaScript never rounds it. The format makes the Go servers parse it into an int64: a malformed id is refused as a 400 before a handler runs. The pattern says the same in the contract, so a client (or a fuzzer) can tell a malformed id from a valid one without trying it. Eighteen digits is the most a key reaches, so every id the schema admits fits an int64.

string format: int64

/^[0-9]{1,18}$/

name

required

string

scopes

required

Array<string>

expiresAt

string format: date-time

revokedAt

string format: date-time

lastUsedAt

string format: date-time

createdAt

required

string format: date-time

updatedAt

required

string format: date-time

Example

{
  "tokenInfo": {
    "scopes": [
      "contacts:read"
    ]
  }
}

400

RFC 7807 bad request response

application/problem+json

RFC 7807 Problem Details

object

code

Why the request was refused, when the client should act on it

string

Allowed values: second_factor_required email_verification_required signup_closed

type

A URI reference that identifies the problem type

string

title

A short, human-readable summary of the problem type

string

status

HTTP status code

integer format: int32

detail

A human-readable explanation specific to this occurrence

string

instance

A URI reference that identifies the specific occurrence

string

errors

Validation errors grouped by field

object

key

additional properties

Array<string>

form

Form-level validation error

string

fields

Field validation errors

object

key

additional properties

string

retryAfter

Seconds to wait before retrying; set on a 429 so a client that only sees the body can show the wait

integer format: int32

debug

Why a 500 happened, sent only by a development server (SPHERICON_ENV=development)

object

error

required

The error that failed the request, or the panic value

string

stack

The goroutine stack of a panic; absent for an error a handler returned

string

requestId

The request id the server log carries for this request

string

method

required

The HTTP method of the failed request

string

path

required

The path of the failed request

string

Example

{
  "code": "second_factor_required"
}

401

RFC 7807 unauthorized response

application/problem+json

RFC 7807 Problem Details

object

code

Why the request was refused, when the client should act on it

string

Allowed values: second_factor_required email_verification_required signup_closed

type

A URI reference that identifies the problem type

string

title

A short, human-readable summary of the problem type

string

status

HTTP status code

integer format: int32

detail

A human-readable explanation specific to this occurrence

string

instance

A URI reference that identifies the specific occurrence

string

errors

Validation errors grouped by field

object

key

additional properties

Array<string>

form

Form-level validation error

string

fields

Field validation errors

object

key

additional properties

string

retryAfter

Seconds to wait before retrying; set on a 429 so a client that only sees the body can show the wait

integer format: int32

debug

Why a 500 happened, sent only by a development server (SPHERICON_ENV=development)

object

error

required

The error that failed the request, or the panic value

string

stack

The goroutine stack of a panic; absent for an error a handler returned

string

requestId

The request id the server log carries for this request

string

method

required

The HTTP method of the failed request

string

path

required

The path of the failed request

string

Example

{
  "code": "second_factor_required"
}

403

RFC 7807 forbidden response

application/problem+json

RFC 7807 Problem Details

object

code

Why the request was refused, when the client should act on it

string

Allowed values: second_factor_required email_verification_required signup_closed

type

A URI reference that identifies the problem type

string

title

A short, human-readable summary of the problem type

string

status

HTTP status code

integer format: int32

detail

A human-readable explanation specific to this occurrence

string

instance

A URI reference that identifies the specific occurrence

string

errors

Validation errors grouped by field

object

key

additional properties

Array<string>

form

Form-level validation error

string

fields

Field validation errors

object

key

additional properties

string

retryAfter

Seconds to wait before retrying; set on a 429 so a client that only sees the body can show the wait

integer format: int32

debug

Why a 500 happened, sent only by a development server (SPHERICON_ENV=development)

object

error

required

The error that failed the request, or the panic value

string

stack

The goroutine stack of a panic; absent for an error a handler returned

string

requestId

The request id the server log carries for this request

string

method

required

The HTTP method of the failed request

string

path

required

The path of the failed request

string

Example

{
  "code": "second_factor_required"
}

429

RFC 7807 too many requests response: a rate limit was exceeded (ADR 0025)

application/problem+json

RFC 7807 Problem Details

object

code

Why the request was refused, when the client should act on it

string

Allowed values: second_factor_required email_verification_required signup_closed

type

A URI reference that identifies the problem type

string

title

A short, human-readable summary of the problem type

string

status

HTTP status code

integer format: int32

detail

A human-readable explanation specific to this occurrence

string

instance

A URI reference that identifies the specific occurrence

string

errors

Validation errors grouped by field

object

key

additional properties

Array<string>

form

Form-level validation error

string

fields

Field validation errors

object

key

additional properties

string

retryAfter

Seconds to wait before retrying; set on a 429 so a client that only sees the body can show the wait

integer format: int32

debug

Why a 500 happened, sent only by a development server (SPHERICON_ENV=development)

object

error

required

The error that failed the request, or the panic value

string

stack

The goroutine stack of a panic; absent for an error a handler returned

string

requestId

The request id the server log carries for this request

string

method

required

The HTTP method of the failed request

string

path

required

The path of the failed request

string

Example

{
  "code": "second_factor_required"
}

Headers

Retry-After

required

integer format: int32

Seconds to wait before retrying

X-RateLimit-Limit

required

integer format: int32

The request budget of the window that was exceeded

X-RateLimit-Remaining

required

integer format: int32

Requests left in the current window

X-RateLimit-Reset

required

integer format: int64

Unix time at which the window resets

Auth_tokensBootstrap

Authorizations

Parameters

Header Parameters

Request Bodyrequired

Responses

201

Example

400

Example

401

Example

403

Example

429

Example

Headers

Request Body^required