Metavault API - Create API token

CreateApiToken - POST

Path	/api/apitokens
Http Method	POST

Overview

no license

Create an API token. API tokens are used as an authentication method to query the API programmatically. See Metavault API - General concepts | Authentication and authorization

Required permissions

Global administration privileges. ADMIN

Request

Request body

JSON

{
  "name": "MyApiKey",
  "expiry": "2026-01-31T00:00:00.000Z",
  "isAdmin": false,
  "accessRights": {}
}

Field descriptions

Field	Type	Required	Description	Constraints
name	string	Yes	The name of the token.
expiry	string	Yes	The timestamp at which the token expires.	A timestamp in ISO-8601 format. Cannot be in the past or more than 366 days in the future.
isAdmin	boolean	No	Whether this token has global administration rights. Defaults to false.
accessRights	object.	No	The object describing explicit access rights to projects. Defaults to no explicit access.	See: Metavault API - General concepts \| Access rights

Response

Success response (200 OK)

JSON

{
  "token": "mvpat-YeWUrekbhRZlTm3pbU2gfC1WpVg83DgpwLmd1/91wSuXoDE=",
  "tokenPrefix":"mvpat-YeWU",
  "id": "5cb94c9bcb74427b9884dced5342a368",
  "name": "MyApiKey",
  "expiry": "2026-01-31T00:00:00Z",
  "creationDate": "2026-01-21T11:09:41.1811414\u002B01:00",
  "isAdmin": false,
  "accessRights" : {}
}

Response fields

Field	Type	Description
id	string	The app-generated id of the token.
token	string	The actual token to send by the client to be authenticated. This will only be sent once, by the creation endpoint. The back-end does not save the full token in cleartext.
tokenPrefix	string	The start of the cleartext token, this will always be sent by the back-end, to identify it easily later on.
name	string	The chosen name of the token.
expiry	string	The expiry datetime of the token.
creationDate	string	The datetime at which the token was created.
isAdmin	boolean	Whether or not this token grants global administration rights.
accessRights	object	The object describing explicit access rights to projects. See: Metavault API - General concepts \| Access rights