Skip to content
NebulaCtrlInstall

Reference

View as Markdown

Tokens API

API tokens.

3 operations. Every call needs a session cookie or an Authorization: Bearer nct_… token unless marked Public. Conventions, errors and scopes

GET/tokens

List API tokens

Response 200 · OK · application/json
ListTokensOutputBody
  • Token[] | nullrequired
Errors
  • 401Unauthorized
  • 403Forbidden
  • 500Internal Server Error

Errors are RFC 9457 application/problem+json with a stable code field.

POST/tokens

Create an API token

Request body · application/json · required
CreateTokenInputBody
  • allowProductionWithoutApprovalboolean
    MCP calls with this token skip the human approval production changes otherwise need. Owner or Admin only; audited. Off by default.
  • expiresAtstring (date-time)
  • namestringrequired
  • projectIdsstring[] | null
    Restrict the token to these projects; omit for all projects
  • requireProductionApprovalboolean
    Calls with this token on production environments need a human approval first. REST tokens are exempt by default so CI and deploy scripts keep working.
  • scopesstring[] | nullrequired
    projects:read, logs:read, projects:write, deployments:write, deployments:rollback, servers:read, servers:write, proxy:write, admin
Response 201 · Created · application/json
CreatedToken
  • allowProductionWithoutApprovalbooleanrequired
    MCP calls with this token skip the production approval. Set by an Owner or Admin when the token is created.
  • createdAtstring (date-time)required
  • expiresAtstring (date-time)
  • idstringrequired
  • lastUsedAtstring (date-time)
  • namestringrequired
  • prefixstringrequired
    First 8 characters after nct_, for identification
  • projectIdsstring[] | null
    Absent when the token can access all projects
  • requireProductionApprovalbooleanrequired
    Calls with this token on production environments need a human approval first (REST tokens are exempt by default so CI keeps working).
  • revokedAtstring (date-time)
  • scopesstring[] | nullrequired
  • tokenstringrequired
    The raw API token. Shown once; store it now.
Errors
  • 401Unauthorized
  • 403Forbidden
  • 422Unprocessable Entity
  • 500Internal Server Error

Errors are RFC 9457 application/problem+json with a stable code field.

DELETE/tokens/{id}

Revoke an API token

ParameterInTypeDescription
idrequiredpathstring
Response 204 · No Content

No body.

Errors
  • 401Unauthorized
  • 403Forbidden
  • 404Not Found
  • 422Unprocessable Entity
  • 500Internal Server Error

Errors are RFC 9457 application/problem+json with a stable code field.