Personal access tokens

3 operations at https://api.zaitrack.app. Request and response bodies are JSON with camelCase keys; ids are UUIDs; times are RFC 3339 in UTC.

A personal access token acts as the person who made it, and every use is audited.

Every operation needs an API key, a personal access token or an OAuth access token unless it says otherwise. An Idempotency-Key is replayed for 24 hours; see Idempotency. Errors are application/problem+json; see Errors.

Your personal access tokens

GET /v1/api-tokens

• Scope: any signed-in caller; the service decides
• Rate class: credentials (10 per minute)
• Idempotency-Key: not used
• Audited: no
• Step-up MFA: no

Request

No body.

Response

200: from the service's OpenAPI document.

Field	Type	Notes
tokens	array of object
tokens[].createdAt	string	required
tokens[].devTenantId	string	required
tokens[].expiresAt	string	required
tokens[].id	string	required
tokens[].ipAllowlist	array of string	required
tokens[].kind	string	required
tokens[].label	string	required
tokens[].last4	string	required
tokens[].mode	string	required
tokens[].ownerUserId	string	required
tokens[].prefix	string	required
tokens[].rotationAfterAt	string	required
tokens[].sandboxId	string
tokens[].scopes	array of string	required
tokens[].secret	string
tokens[].status	string	required

Example

curl "https://api.zaitrack.app/v1/api-tokens" \
  -H "Authorization: Bearer zk_test_…"

Mint a personal access token (shown once)

POST /v1/api-tokens

Call it with an OAuth access token from your own signed-in session: tenancy-service refuses API keys and other non-interactive credentials, and a token's scopes are never wider than yours. The token (zpat_…) is in the response once.

• Scope: any signed-in caller; the service decides
• Rate class: credentials (10 per minute)
• Idempotency-Key: not used
• Audited: no
• Step-up MFA: no

Request

From the service's OpenAPI document.

Field	Type	Notes
ipAllowlist	array of string	required
label	string	required
scopes	array of string	required
ttlDays	integer	required

Response

201: from the service's OpenAPI document.

Field	Type	Notes
createdAt	string	required
devTenantId	string	required
expiresAt	string	required
id	string	required
ipAllowlist	array of string	required
kind	string	required
label	string	required
last4	string	required
mode	string	required
ownerUserId	string	required
prefix	string	required
rotationAfterAt	string	required
sandboxId	string
scopes	array of string	required
secret	string
status	string	required

Example

Every field is sent with a placeholder value: replace them with yours.

curl -X POST "https://api.zaitrack.app/v1/api-tokens" \
  -H "Authorization: Bearer zk_test_…" \
  -H "Content-Type: application/json" \
  -d '{"ipAllowlist": [], "label": "…", "scopes": [], "ttlDays": 0}'

Revoke a personal access token

POST /v1/api-tokens/{id}:revoke

• Scope: any signed-in caller; the service decides
• Rate class: credentials (10 per minute)
• Idempotency-Key: not used
• Audited: no
• Step-up MFA: no

Path parameters: id.

Request

No body: the OpenAPI document declares none.

Response

200: from the service's OpenAPI document.

The same fields as the response of Mint a personal access token (shown once).

Example

curl -X POST "https://api.zaitrack.app/v1/api-tokens/$ID:revoke" \
  -H "Authorization: Bearer zk_test_…"