Skip to content
Docs
Esc
↑↓navigate↵open⌘Jpreview

Create a machine access credential

Creates a scoped grant and returns its opaque bearer token exactly once. Tokens are accepted only in the Authorization header.

POST/v1/spaces/{spaceId}/machine-credentials
Authorization
AuthorizationBearer token · headerrequired

Better Auth session, OAuth access token, OAuth client-credentials token, or sfm_ Space machine credential.

Path parameters
spaceIdstringrequired
Request body
requiredapplication/json
namestringrequired
min length 1 · max length 120
resourcesobjectrequired
Show properties
includestring[]required
min items 1 · max items 100
excludestring[]
max items 100 · default: []
capabilitiesstring[]required
min items 1 · max items 5
constraintsobject
default: {}
Show properties
notBeforestring<date-time> | string
Show properties
Any of:
string<date-time>
string<date-time>
string
string
expiresAtstring<date-time> | string
Show properties
Any of:
string<date-time>
string<date-time>
string
string
maxUsesinteger
max 1000000
requireVerifiedEmailboolean
networkobject
Show properties
ipCidrsstring[]

IP address and CIDR Grants are unsupported because the serving runtime has no trusted visitor IP. Remove the IP constraint.

min items 1 · max items 50
countriesstring[]
min items 1 · max items 250
excludedCountriesstring[]
min items 1 · max items 250
excludedUserAgentSubstringsstring[]
min items 1 · max items 50
frameOriginstring
min length 1 · max length 2048
targetobjectrequired
Show properties
One of:
object
kindstringrequired
object
kindstringrequired
versionIdstringrequired
min length 1 · max length 255
object
kindstringrequired
branchstringrequired
min length 1 · max length 255
object
kindstringrequired
Responses
201

Response for status 201

$schemastring<uri>

Canonical JSON Schema URL for this response body. The server also sends it in the Link: rel="describedby" response header.

dataobjectrequired
Show properties
credentialobjectrequired
Show properties
idstringrequired
matches ^(mch_)[A-Za-z0-9]+$
grantobjectrequired
Show properties
grantobjectrequired
Show properties
namestring
min length 1 · max length 120
audienceobjectrequired
Show properties
One of:
object
kindstringrequired
object
kindstringrequired
teamIdstringrequired
min length 1 · max length 255
object
kindstringrequired
personIdstringrequired
min length 1 · max length 255
object
kindstringrequired
linkIdstringrequired
min length 1 · max length 255
object
kindstringrequired
credentialIdstringrequired
min length 1 · max length 255
object
kindstringrequired
machineIdstringrequired
min length 1 · max length 255
object
kindstringrequired
issuerstringrequired
min length 1 · max length 255
subjectstringrequired
min length 1 · max length 255
resourcesobjectrequired
Show properties
includestring[]required
min items 1 · max items 100
excludestring[]required
max items 100 · default: []
capabilitiesstring[]required
min items 1 · max items 5
constraintsobjectrequired
default: {}
Show properties
notBeforestring<date-time> | string
Show properties
Any of:
string<date-time>
string<date-time>
string
string
expiresAtstring<date-time> | string
Show properties
Any of:
string<date-time>
string<date-time>
string
string
maxUsesinteger
max 1000000
requireVerifiedEmailboolean
networkobject
Show properties
ipCidrsstring[]

IP address and CIDR Grants are unsupported because the serving runtime has no trusted visitor IP. Remove the IP constraint.

min items 1 · max items 50
countriesstring[]
min items 1 · max items 250
excludedCountriesstring[]
min items 1 · max items 250
excludedUserAgentSubstringsstring[]
min items 1 · max items 50
frameOriginstring
min length 1 · max length 2048
targetobjectrequired
Show properties
One of:
object
kindstringrequired
object
kindstringrequired
versionIdstringrequired
min length 1 · max length 255
object
kindstringrequired
branchstringrequired
min length 1 · max length 255
object
kindstringrequired
idstringrequired
matches ^(grt_)[A-Za-z0-9]+$
sourceobjectrequired
Show properties
kindstringrequired
Allowed:configmanagedsystem
referencestringrequired
min length 1 · max length 255
generationintegerrequired
max 9007199254740991
statusstringrequired
Allowed:scheduledactiveexpired
sourceExplanationobjectrequired
Show properties
editablebooleanrequired
labelstringrequired
min length 1
detailstringrequired
min length 1
createdAtstring<date-time>required
matches ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z))$
updatedAtstring<date-time>required
matches ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z))$
tokenHintstringrequired
min length 1 · max length 32
rotatedAtstring<date-time> | nullrequired
Show properties
Any of:
string<date-time>
string<date-time>
null
null
lastUsedAtstring<date-time> | nullrequired
Show properties
Any of:
string<date-time>
string<date-time>
null
null
revokedAtstring<date-time> | nullrequired
Show properties
Any of:
string<date-time>
string<date-time>
null
null
tokenstringrequired
min length 32 · max length 256
default

Problem details (RFC 9457). Any 4xx/5xx response is one application/problem+json document.

$schemastring<uri>

Canonical JSON Schema URL for this response body. The server also sends it in the Link: rel="describedby" response header.

typestringrequired

Problem type URI resolving to the error docs page. The server derives it mechanically from code against the docs origin.

titlestringrequired

Short human-readable summary of the problem type. The server derives it mechanically from code.

statusintegerrequired

HTTP status code of this response, repeated in the body.

min -9007199254740991 · max 9007199254740991
detailstringrequired

Human-readable failure explanation for this occurrence.

codestringrequired

Stable snake_case error code naming the failed public contract.

pointerstring

RFC 6901 JSON Pointer into the failing request field, for example "/files/37/path", on validation failures.

detailsobject

Machine-readable context for the error code.

fixstring

One sentence on what to do about this error code, the same text as the type page. Read it before retrying.

suggestionsstring[]

Actionable recovery steps safe to show in dashboards, SDKs, and CLI output.

nextstring[]

Copy-pasteable commands or API requests an agent can run next.

requestIdstringrequired

The request id to quote when contacting support.

Try it
Server
Authorization
Parameters
Bodyapplication/json
Request
curl -X POST 'https://api.spacefast.com/v1/spaces/string/machine-credentials' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
  "name": "string",
  "resources": {
    "include": [
      "string"
    ],
    "exclude": []
  },
  "capabilities": [
    "page.view"
  ],
  "constraints": {},
  "target": {
    "kind": "live"
  }
}'
Response
{
  "$schema": "http://example.com",
  "data": {
    "credential": {
      "id": "string",
      "grant": {
        "grant": {
          "name": "string",
          "audience": {
            "kind": "public"
          },
          "resources": {
            "include": [
              "string"
            ],
            "exclude": []
          },
          "capabilities": [
            "page.view"
          ],
          "constraints": {},
          "target": {
            "kind": "live"
          },
          "id": "string",
          "source": {
            "kind": "config",
            "reference": "string"
          }
        },
        "generation": 1,
        "status": "scheduled",
        "sourceExplanation": {
          "editable": true,
          "label": "string",
          "detail": "string"
        },
        "createdAt": "2019-08-24T14:15:22Z",
        "updatedAt": "2019-08-24T14:15:22Z"
      },
      "tokenHint": "string",
      "rotatedAt": "2019-08-24T14:15:22Z",
      "lastUsedAt": "2019-08-24T14:15:22Z",
      "revokedAt": "2019-08-24T14:15:22Z"
    },
    "token": "stringstringstringstringstringst"
  }
}

Was this page helpful?