Skip to main content
POST
cURL

Authorizations

Authorization
string
header
required

Send Authorization: Bearer <api_key>. The legacy Authorization: Api-Key <api_key> scheme is also accepted.

Body

application/json
scopes
enum<string>[]
required

Capabilities the token grants, at least one. Requesting PUSH or TAG requires organization-level model management permission.

Minimum array length: 1

Capability a volume token grants.

  • PULL: read volume data.
  • INSPECT: read volume metadata without data access.
  • PUSH: upload and commit volume versions.
  • TAG: move or remove tags.
Available options:
PULL,
INSPECT,
PUSH,
TAG
namespaces
string[]
required

Volume namespaces the token is limited to, lowercase ASCII, at least one. Pass only the namespaces the operation needs.

Minimum array length: 1
volumes
string[]
required

Volume names the token is limited to, lowercase ASCII, exact names only, at least one. The limit applies to every requested scope in every requested namespace.

Minimum array length: 1
correlation_id
string | null

Optional client-chosen identifier, at most 128 printable ASCII characters. Echoed into server logs to link the issued token to a client operation.

Maximum string length: 128
Pattern: ^[\x21-\x7e]+$

Response

200 - application/json
token
string
required

Volume access token. Pass as a bearer token to the volume APIs.

expires_at
string<date-time>
required

Token expiry in ISO 8601 format. Tokens cannot be renewed; exchange again for a fresh token.

scopes
enum<string>[]
required

Effective capabilities granted.

Capability a volume token grants.

  • PULL: read volume data.
  • INSPECT: read volume metadata without data access.
  • PUSH: upload and commit volume versions.
  • TAG: move or remove tags.
Available options:
PULL,
INSPECT,
PUSH,
TAG
namespaces
string[]
required

Effective namespaces granted, in canonical lowercase form.

volumes
string[]
required

Effective volume names granted, in canonical lowercase form.

bdn_endpoint
string | null
required

Base URL of the volume API this token authenticates against. Null when the environment does not expose a public volume API yet.