> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sndbox.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Post v1personal access tokens



## OpenAPI

````yaml /api-reference/openapi.json post /v1/personal-access-tokens
openapi: 3.1.0
info:
  title: sndbox Control Plane API
  version: 0.5.0
  description: >-
    Versioned v1 route and transport contract. Resource schemas remain additive
    during the v0.5 GA candidate.
servers:
  - url: https://api.sndbox.app
security: []
paths:
  /v1/personal-access-tokens:
    post:
      tags:
        - personal-access-tokens
      operationId: post_v1_personal_access_tokens
      parameters:
        - $ref: '#/components/parameters/CorrelationId'
        - $ref: '#/components/parameters/IdempotencyKey'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PersonalAccessTokenInput'
      responses:
        '200':
          description: Successful response.
          headers:
            x-correlation-id:
              $ref: '#/components/headers/CorrelationId'
            idempotency-replayed:
              $ref: '#/components/headers/IdempotencyReplayed'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IssuedCredentialEnvelope'
        '400':
          $ref: '#/components/responses/ApiError'
        '401':
          $ref: '#/components/responses/ApiError'
        '403':
          $ref: '#/components/responses/ApiError'
        '404':
          $ref: '#/components/responses/ApiError'
        '409':
          $ref: '#/components/responses/ApiError'
        '429':
          $ref: '#/components/responses/RateLimited'
        '500':
          $ref: '#/components/responses/ApiError'
        '503':
          $ref: '#/components/responses/ApiError'
      security:
        - bearerAuth: []
components:
  parameters:
    CorrelationId:
      name: x-correlation-id
      in: header
      required: false
      schema:
        type: string
        minLength: 8
        maxLength: 128
        pattern: ^[A-Za-z0-9][A-Za-z0-9._:-]+$
      description: Caller-supplied correlation ID; the server generates one when omitted.
    IdempotencyKey:
      name: Idempotency-Key
      in: header
      required: false
      schema:
        type: string
        minLength: 16
        maxLength: 200
        pattern: ^[A-Za-z0-9._:-]+$
      description: Enables exact replay for mutating requests for 24 hours.
  schemas:
    PersonalAccessTokenInput:
      type: object
      required:
        - name
        - scopes
        - organisationId
        - workspaceIds
      properties:
        name:
          type: string
          minLength: 1
          maxLength: 120
        scopes:
          type: array
          items:
            type: string
        organisationId:
          type: string
          format: uuid
        workspaceIds:
          type: array
          minItems: 1
          items:
            type: string
            format: uuid
        environmentIds:
          type: array
          items:
            type: string
            format: uuid
          default: []
        expiresInDays:
          type: integer
          minimum: 1
          maximum: 90
          default: 30
      additionalProperties: false
    IssuedCredentialEnvelope:
      type: object
      required:
        - credential
      properties:
        credential:
          $ref: '#/components/schemas/IssuedCredential'
      additionalProperties: false
    IssuedCredential:
      type: object
      required:
        - id
        - name
        - prefix
        - scopes
        - organisationId
        - workspaceIds
        - environmentIds
        - createdAt
        - expiresAt
        - token
      properties:
        id:
          type: string
          format: uuid
        name:
          type: string
        prefix:
          type: string
        scopes:
          type: array
          items:
            type: string
        organisationId:
          type: string
          format: uuid
        workspaceIds:
          type: array
          items:
            type: string
            format: uuid
        environmentIds:
          type: array
          items:
            type: string
            format: uuid
        createdAt:
          type: string
          format: date-time
        expiresAt:
          type: string
          format: date-time
        token:
          type: string
          description: >-
            Secret returned only on issuance or exact encrypted idempotent
            replay.
      additionalProperties: false
    ApiError:
      type: object
      required:
        - error
        - correlationId
      properties:
        error:
          type: object
          required:
            - code
            - message
          properties:
            code:
              type: string
            message:
              type: string
            details: {}
        correlationId:
          type: string
  headers:
    CorrelationId:
      schema:
        type: string
      description: Correlation ID for this request.
    IdempotencyReplayed:
      schema:
        type: string
        enum:
          - 'true'
      description: Present only when the response was replayed.
  responses:
    ApiError:
      description: Structured API error.
      headers:
        x-correlation-id:
          schema:
            type: string
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ApiError'
    RateLimited:
      description: Rate limit exceeded.
      headers:
        retry-after:
          schema:
            type: integer
        x-ratelimit-limit:
          schema:
            type: integer
        x-ratelimit-remaining:
          schema:
            type: integer
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ApiError'
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer

````