Tokens

All path parameters are required.

Tokens authenticate API requests. Every token carries a set of capability scopes that limits what it can read or write. The plaintext code is returned exactly once at creation. The server stores only a SHA-256 hash of it, so you cannot retrieve it again.

There are three token subjects:

Subject	Bound to	Created by
USER	A user account	POST /v1/tokens or POST /v1/users/{uid}/tokens
WORKSPACE	A workspace	POST /v1/workspaces/{wid}/tokens
RESOURCE	One resource inside a workspace	POST /v1/workspaces/{wid}/tokens with subject and subject_id

Session tokens (origin: SESSION) are minted at login and cannot be created through the API. They carry all capability scopes and can be refreshed within the last six hours of their lifetime.

---

Only login sessions can create tokens. API and OAuth tokens cannot create other tokens.

Available scopes

app:read, app:write, audit:read, dedibox:read, dedibox:write, disk:read, disk:write, floating_ip:read, floating_ip:write, image:read, image:write, instance:read, instance:write, net_balancer:read, net_balancer:write, workspace:read, workspace:write.

Create a token (caller shorthand)

POST/v1/tokensCreate a USER-scope token for the authenticated user

Alias for POST /v1/users/@me/tokens. Creates a USER-subject API token bound to the authenticated user. The token can reach every workspace the user can access, gated by the supplied scopes.

Request body

Field	Type	Required	Description
name	string	yes	Token name, 4-48 characters
expires	string (ISO 8601)	yes	Expiration timestamp, between 7 and 365 days from creation
scopes	string[]	yes	Nonempty set of capability scopes. See Available scopes.

curl -X POST https://api.galaxygate.net/v1/tokens \
  -H "Authorization: Bearer $GALAXYGATE_TOKEN" \
  -H "Content-Type: application/json" \
  -A 'curl/8.5' \
  -d '{
    "name": "ci-deploy",
    "expires": "2027-01-01T00:00:00Z",
    "scopes": ["workspace:read", "instance:write", "image:read"]
  }'

Returns 200 OK with a token creation response (see Token creation response).

Create a USER-scope token

POST/v1/users/{uid}/tokensCreate a USER-scope API token

Creates a USER-subject API token bound to the given user. The uid must match the authenticated user unless the caller is staff. @me is accepted as an alias for the current user's ID.

Path parameters

Name	Type	Description
uid	string	User ID, or @me

Request body - same as POST /v1/tokens above.

Returns 200 OK with a token creation response.

List user tokens

GET/v1/users/{uid}/tokensList user-scope tokens

Lists USER-subject tokens (both SESSION and API origin) bound to the given user account.

Path parameters

Name	Type	Description
uid	string	User ID, or @me

Query parameters

Name	Type	Description
q	string	Quick search by name or ID
id	string[]	Filter to specific token IDs
name	string	Filter by name
origin	string	Filter by origin: SESSION, API, SYSTEM, or OAUTH
subject	string	Filter by subject: USER, WORKSPACE, or RESOURCE

All filters are optional. Supports the shared pagination parameters. Returns 200 OK with a paged list of token objects.

Revoke all user sessions

DELETE/v1/users/{uid}/tokensRevoke all user sessions

Revokes all active SESSION-origin tokens for the given user. API tokens are not touched. Useful for forcing a global sign-out after a password change or suspected compromise.

Path parameters

Name	Type	Description
uid	string	User ID, or @me

Returns 202 Accepted with an empty body.

Fetch a token

GET/v1/tokens/{tid}Fetch a token

Returns metadata for a single token. USER-subject tokens are visible to their owning user. Workspace and resource tokens are visible to an administrator on the owning workspace. The plaintext code is never returned.

Path parameters

Name	Type	Description
tid	string	Token ID

Returns 200 OK with a token object (see Token object).

Delete a token

DELETE/v1/tokens/{tid}Delete a token

Deletes a token, immediately invalidating it. USER-subject tokens can be deleted by their owning user. Workspace and resource tokens require the Administrator role on the owning workspace.

Path parameters

Name	Type	Description
tid	string	Token ID

Returns 202 Accepted with an empty body.

Refresh a session token

POST/v1/tokens/refreshRefresh a session token

Resets the expiration of a SESSION-origin token. The token must belong to the authenticated user, must not be expired and must be within the last six hours of its lifetime (the refresh window). Only SESSION tokens can be refreshed. API tokens cannot.

Request body

Field	Type	Required	Description
code	string	yes	Plaintext session token code to refresh

Returns 200 OK with an object containing a single field:

Field	Type	Description
expires	string (ISO 8601)	New expiration timestamp

---

Workspace token endpoints

List workspace tokens

GET/v1/workspaces/{wid}/tokensList workspace-scope tokens

Lists tokens that belong to a workspace or any of its resources. Requires the Administrator role on the workspace.

Path parameters

Name	Type	Description
wid	string	Workspace ID

Query parameters - same as List user tokens above.

All filters are optional. Supports the shared pagination parameters. Returns 200 OK with a paged list of token objects.

Create a workspace or resource token

POST/v1/workspaces/{wid}/tokensCreate a workspace-scope or resource-scope token

Creates a token bound to a workspace or to one of its resources. Requires the Administrator role.

For a workspace-scoped token, omit subject and subject_id (or send subject: "WORKSPACE"). For a resource-scoped token, set subject to RESOURCE and provide subject_id with the ID of the resource. The resource must belong to the path workspace.

Path parameters

Name	Type	Description
wid	string	Workspace ID

Request body

Field	Type	Required	Description
name	string	yes	Token name, 4-48 characters
expires	string (ISO 8601)	yes	Expiration timestamp, between 7 and 365 days from creation
scopes	string[]	yes	Nonempty set of capability scopes. See Available scopes.
subject	string or null		WORKSPACE (default) or RESOURCE
subject_id	string or null		Resource ID. Required when subject is RESOURCE. Scopes must refer to exactly one resource kind: instance, dedibox, app, image, net_balancer, disk, or floating_ip.

curl -X POST https://api.galaxygate.net/v1/workspaces/42/tokens \
  -H "Authorization: Bearer $GALAXYGATE_TOKEN" \
  -H "Content-Type: application/json" \
  -A 'curl/8.5' \
  -d '{
    "name": "instance-reader",
    "expires": "2027-06-01T00:00:00Z",
    "scopes": ["instance:read"],
    "subject": "RESOURCE",
    "subject_id": "101"
  }'

Returns 200 OK with a token creation response.

---

Token creation response

The response from any create endpoint includes a code field containing the plaintext token. This is the only time it is exposed.

Field	Type	Description
id	string	Token ID
name	string or null	Token name
created	string (ISO 8601)	When the token was created
expires	string (ISO 8601) or null	When the token expires
origin	string	How the token was created: SESSION, API, SYSTEM, or OAUTH
subject	string	What the token is bound to: USER, WORKSPACE, or RESOURCE
subject_id	string	ID of the bound entity
workspace_id	string or null	Workspace the token can reach (null for USER-subject tokens)
scopes	string[]	Granted capability scopes
code	string	Plaintext token. Save this securely. It is never returned again.

Token object

Returned by fetch and list endpoints. Includes the creation metadata without code, plus ownership and usage details.

Field	Type	Description
id	string	Token ID
name	string or null	Token name
created	string (ISO 8601)	When the token was created
expires	string (ISO 8601) or null	When the token expires, or null for non-expiring tokens
origin	string	SESSION, API, SYSTEM, or OAUTH
subject	string	USER, WORKSPACE, or RESOURCE
subject_id	string	ID of the bound entity
workspace_id	string or null	Workspace the token can reach, or null
scopes	string[]	Granted capability scopes
user	object or null	User account that owns this token (USER-subject only)
created_by	object or null	User who created the token
last_ip	string or null	Last IP address that used this token
last_used	string (ISO 8601) or null	Last time this token was used

---

Revoke exposed credentials

POST/v1/credentials/revokeRevoke exposed credentials

We permanently revoke exposed credentials and notify their owners. The response is 202 even when a credential is invalid. Send between 1 and 100 credentials, each at most 256 characters. The optional url accepts a public HTTP or HTTPS URL up to 2048 characters. The optional source accepts up to 64 letters, digits, dots, underscores, or hyphens.

No authentication required.

Request body

Field	Type	Required	Description
credentials	string[]	yes	Exposed credentials
source	string or null		Kind of source the credentials were found in
url	string or null		Public http(s) URL where the credentials were found

{"credentials": ["<exposed-token>"], "source": "commit"}

Returns 202 Accepted with an empty body.