POST /v1/tokens

Create a named token, admin token only. The plain token is returned once; only its hash is kept.

Auth. Admin token only. Any other caller gets a 404, the same as an unknown route.

Request body

application/json: object

FieldTypeRequiredDescription
namestringrequired
scopestring: one of read, writerequiredread allows GET requests only; write allows every request except token management

Responses

StatusMeaningBody
201Created. The token is in this response only.ApiToken and object
400Request rejectedError
404Not found. Any caller without the admin token gets this, the same as an unknown route.Error
429Too many requests from this client address. Wait the number of seconds in Retry-After, then try again.Error

Example response

{
  "id": 0,
  "name": "string",
  "scope": "read",
  "created_at": "2026-10-11T00:00:00Z",
  "last_used_at": "2026-10-11T00:00:00Z",
  "revoked_at": "2026-10-11T00:00:00Z",
  "token": "string"
}

Code samples

Set KEY to your own token first.

curl

curl \
  -X POST \
  -H X-Ledger-Token:$KEY \
  -H "Content-Type: application/json" \
  -d '{"name": "string", "scope": "read"}' \
  "https://api.sasek.org/ledger/v1/tokens"

JavaScript

const res = await fetch("https://api.sasek.org/ledger/v1/tokens", {
  method: "POST",
  headers: { "X-Ledger-Token": KEY, "Content-Type": "application/json" },
  body: JSON.stringify({
    "name": "string",
    "scope": "read"
  }),
});
const data = await res.json();

Python

import json
import os
import urllib.request

payload = {'name': 'string', 'scope': 'read'}

request = urllib.request.Request(
    "https://api.sasek.org/ledger/v1/tokens",
    method="POST",
    headers={
        "X-Ledger-Token": os.environ["KEY"],
        "Content-Type": "application/json",
    },
    data=json.dumps(payload).encode(),
)
with urllib.request.urlopen(request) as response:
    print(json.load(response))