# Tokens API

API tokens. 3 operations under /api/v1. Errors are RFC 9457 problem+json with a stable `code` field. The complete schemas are in https://nebulactrl.com/api/v1/openapi.json.

## GET /tokens

List API tokens

Authentication: session cookie or `Authorization: Bearer nct_…` token.

Response 200: OK (ListTokensOutputBody)
  - `items` (Token[] | null, required)
Errors: 401 Unauthorized; 403 Forbidden; 500 Internal Server Error

## POST /tokens

Create an API token

Authentication: session cookie or `Authorization: Bearer nct_…` token.

Request body (application/json, required): CreateTokenInputBody
  - `allowProductionWithoutApproval` (boolean): MCP calls with this token skip the human approval production changes otherwise need. Owner or Admin only; audited. Off by default.
  - `expiresAt` (string (date-time))
  - `name` (string, required)
  - `projectIds` (string[] | null): Restrict the token to these projects; omit for all projects
  - `requireProductionApproval` (boolean): Calls with this token on production environments need a human approval first. REST tokens are exempt by default so CI and deploy scripts keep working.
  - `scopes` (string[] | null, required): projects:read, logs:read, projects:write, deployments:write, deployments:rollback, servers:read, servers:write, proxy:write, admin

Response 201: Created (CreatedToken)
  - `allowProductionWithoutApproval` (boolean, required): MCP calls with this token skip the production approval. Set by an Owner or Admin when the token is created.
  - `createdAt` (string (date-time), required)
  - `expiresAt` (string (date-time))
  - `id` (string, required)
  - `lastUsedAt` (string (date-time))
  - `name` (string, required)
  - `prefix` (string, required): First 8 characters after nct_, for identification
  - `projectIds` (string[] | null): Absent when the token can access all projects
  - `requireProductionApproval` (boolean, required): Calls with this token on production environments need a human approval first (REST tokens are exempt by default so CI keeps working).
  - `revokedAt` (string (date-time))
  - `scopes` (string[] | null, required)
  - `token` (string, required): The raw API token. Shown once; store it now.
Errors: 401 Unauthorized; 403 Forbidden; 422 Unprocessable Entity; 500 Internal Server Error

## DELETE /tokens/{id}

Revoke an API token

Authentication: session cookie or `Authorization: Bearer nct_…` token.

Parameters:
- `id` (path, string, required)

Response 204: No Content
Errors: 401 Unauthorized; 403 Forbidden; 404 Not Found; 422 Unprocessable Entity; 500 Internal Server Error