Create a scoped access token

curl --request POST \
  --url https://api.example.com/api/ee/scoped_access_token \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "repoIds": [
    1
  ]
}
'

import requests

url = "https://api.example.com/api/ee/scoped_access_token"

payload = { "repoIds": [1] }
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({repoIds: [1]})
};

fetch('https://api.example.com/api/ee/scoped_access_token', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.example.com/api/ee/scoped_access_token",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'repoIds' => [
        1
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.example.com/api/ee/scoped_access_token"

	payload := strings.NewReader("{\n  \"repoIds\": [\n    1\n  ]\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.example.com/api/ee/scoped_access_token")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"repoIds\": [\n    1\n  ]\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.example.com/api/ee/scoped_access_token")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"repoIds\": [\n    1\n  ]\n}"

response = http.request(request)
puts response.read_body

{
  "id": "<string>",
  "token": "<string>",
  "createdAt": "2023-11-07T05:31:56Z",
  "expiresAt": "2023-11-07T05:31:56Z",
  "repoIds": [
    1
  ]
}

{
  "statusCode": 123,
  "errorCode": "<string>",
  "message": "<string>"
}

{
  "statusCode": 123,
  "errorCode": "<string>",
  "message": "<string>"
}

{
  "statusCode": 123,
  "errorCode": "<string>",
  "message": "<string>"
}

{
  "statusCode": 123,
  "errorCode": "<string>",
  "message": "<string>"
}

Scoped Access Tokens

Create a scoped access token

Creates an opaque bearer token that expires exactly one hour after issuance and is restricted to the requested repositories. Repository IDs are validated atomically against the API-key owner’s current access; the request fails if any ID is missing or inaccessible. Repository IDs are returned by GET /api/repos.

This endpoint requires a Sourcebot API key. Scoped access tokens, OAuth tokens, and browser sessions cannot mint another scoped access token. The returned token is independent of the API key after issuance and cannot be refreshed.

POST

api

scoped_access_token

Create a scoped access token

curl --request POST \
  --url https://api.example.com/api/ee/scoped_access_token \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "repoIds": [
    1
  ]
}
'

import requests

url = "https://api.example.com/api/ee/scoped_access_token"

payload = { "repoIds": [1] }
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({repoIds: [1]})
};

fetch('https://api.example.com/api/ee/scoped_access_token', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.example.com/api/ee/scoped_access_token",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'repoIds' => [
        1
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.example.com/api/ee/scoped_access_token"

	payload := strings.NewReader("{\n  \"repoIds\": [\n    1\n  ]\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.example.com/api/ee/scoped_access_token")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"repoIds\": [\n    1\n  ]\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.example.com/api/ee/scoped_access_token")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"repoIds\": [\n    1\n  ]\n}"

response = http.request(request)
puts response.read_body

{
  "id": "<string>",
  "token": "<string>",
  "createdAt": "2023-11-07T05:31:56Z",
  "expiresAt": "2023-11-07T05:31:56Z",
  "repoIds": [
    1
  ]
}

{
  "statusCode": 123,
  "errorCode": "<string>",
  "message": "<string>"
}

{
  "statusCode": 123,
  "errorCode": "<string>",
  "message": "<string>"
}

{
  "statusCode": 123,
  "errorCode": "<string>",
  "message": "<string>"
}

{
  "statusCode": 123,
  "errorCode": "<string>",
  "message": "<string>"
}

Authorizations

Authorization

string

header

required

Bearer authentication header of the form Bearer <token>. The token may be a Sourcebot API key, OAuth access token, or scoped access token, subject to endpoint requirements.

Body

application/json

repoIds

integer[]

required

Repository IDs to bind to the token. Every ID must identify a repository accessible to the API-key owner.

Minimum array length: 1

Required range: x > 0

Response

Scoped access token created. The opaque token value is returned only in this response.

string

required

Identifier used to revoke the token.

token

string

required

Opaque bearer token. This value is returned only when the token is created.

Pattern: ^sbst_

createdAt

string<date-time>

required

expiresAt

string<date-time>

required

repoIds

integer[]

required

Minimum array length: 1

Required range: x > 0

⌘I

Overview

Search & Navigation

Repositories

Scoped Access Tokens

Git

Enterprise Management

System

Create a scoped access token

Authorizations

Body

Response