0.x — pre-release, no compatibility promise yet.What this means
Mint an access token (the token is shown once)
Mint a token. The response’s token is the only time it is ever shown — store it now. Yourself by default;
principal_user_id = a service account of the org (owner / admin). The org’s policy applies (personal tokens
allowed? expiry required? maximum lifetime?).
Authorizations
Section titled “Authorizations”Request Bodyrequired
Section titled “Request Bodyrequired”The request body of tokens.create.
object
The organization the token belongs to (a token is org-bound)
What the token is for
live (tm_live_…) or test (tm_test_…: authenticates and reads, never writes)
Namespaced scopes: tasks:read, tasks:write, projects:read, projects:write, teams:read, teams:write, org:read, org:write, webhooks:read, webhooks:write, admin. admin implies every scope; <ns>:write implies <ns>:read.
Example
{ "org_id": "string", "name": "CI deploys", "kind": "live", "scopes": [ "tasks:write", "projects:read" ], "project_ids": [ "string" ], "expires_at": "2026-09-25T12:00:00Z", "principal_user_id": "3f1c2a9e-0b7d-4c1e-9a55-2b8f0d6e4a10"}Responses
Section titled “ Responses ”Successful Response
Returned by tokens.create and tokens.rotate.
object
Who the token acts as
The first 12 characters (tm_live_ab12) — the token itself is never shown again
THE TOKEN — shown once, never stored (only its SHA-256 is). Send it as Authorization: Bearer <token>.
Example
{ "created_at": "2026-09-25T12:00:00Z", "created_by": "3f1c2a9e-0b7d-4c1e-9a55-2b8f0d6e4a10", "expires_at": "2026-12-31T00:00:00Z", "grant_type": "personal", "kind": "live", "name": "CI deploys", "org_id": "O0020", "principal_display": "ada", "principal_user_id": "3f1c2a9e-0b7d-4c1e-9a55-2b8f0d6e4a10", "scopes": [ "tasks:write" ], "status": "active", "token": "tm_live_Ab3xQ9eLr0v2Zk5n8WcHt1YpUo4MiGs7Fj6Da-_Bq0R", "token_id": "TK123456", "token_prefix": "tm_live_Ab3x", "updated_at": "2026-09-25T12:00:00Z", "use_count": 0}Bad request — a query parameter outside what the operation accepts (invalid-parameter)
An RFC 9457 problem details object — the body of every error response. detail is the human-readable explanation; request_id identifies the request for support.
object
about:blank or a urn:tasksmate:problem:* identifier
Human-readable explanation (a string; for a 422, the list of validation errors)
Structured failures: validation errors, or {loc, msg, allowed} for a bad parameter
object
Example
{ "type": "about:blank", "title": "Bad request", "status": 400, "detail": "…", "instance": "/v1/…", "request_id": "9b2f1c1e-8c1a-4a53-9f9e-0f5f1f2d7c11"}Missing or invalid bearer token
An RFC 9457 problem details object — the body of every error response. detail is the human-readable explanation; request_id identifies the request for support.
object
about:blank or a urn:tasksmate:problem:* identifier
Human-readable explanation (a string; for a 422, the list of validation errors)
Structured failures: validation errors, or {loc, msg, allowed} for a bad parameter
object
Example
{ "type": "about:blank", "title": "Missing or invalid bearer token", "status": 401, "detail": "…", "instance": "/v1/…", "request_id": "9b2f1c1e-8c1a-4a53-9f9e-0f5f1f2d7c11"}Authenticated, but not allowed
An RFC 9457 problem details object — the body of every error response. detail is the human-readable explanation; request_id identifies the request for support.
object
about:blank or a urn:tasksmate:problem:* identifier
Human-readable explanation (a string; for a 422, the list of validation errors)
Structured failures: validation errors, or {loc, msg, allowed} for a bad parameter
object
Example
{ "type": "about:blank", "title": "Authenticated, but not allowed", "status": 403, "detail": "…", "instance": "/v1/…", "request_id": "9b2f1c1e-8c1a-4a53-9f9e-0f5f1f2d7c11"}Not found
An RFC 9457 problem details object — the body of every error response. detail is the human-readable explanation; request_id identifies the request for support.
object
about:blank or a urn:tasksmate:problem:* identifier
Human-readable explanation (a string; for a 422, the list of validation errors)
Structured failures: validation errors, or {loc, msg, allowed} for a bad parameter
object
Example
{ "type": "about:blank", "title": "Not found", "status": 404, "detail": "…", "instance": "/v1/…", "request_id": "9b2f1c1e-8c1a-4a53-9f9e-0f5f1f2d7c11"}Conflict (a duplicate, or an Idempotency-Key still in flight)
An RFC 9457 problem details object — the body of every error response. detail is the human-readable explanation; request_id identifies the request for support.
object
about:blank or a urn:tasksmate:problem:* identifier
Human-readable explanation (a string; for a 422, the list of validation errors)
Structured failures: validation errors, or {loc, msg, allowed} for a bad parameter
object
Example
{ "type": "about:blank", "title": "Conflict (a duplicate, or an `Idempotency-Key` still in flight)", "status": 409, "detail": "…", "instance": "/v1/…", "request_id": "9b2f1c1e-8c1a-4a53-9f9e-0f5f1f2d7c11"}If-Match does not match the current ETag
An RFC 9457 problem details object — the body of every error response. detail is the human-readable explanation; request_id identifies the request for support.
object
about:blank or a urn:tasksmate:problem:* identifier
Human-readable explanation (a string; for a 422, the list of validation errors)
Structured failures: validation errors, or {loc, msg, allowed} for a bad parameter
object
Example
{ "type": "about:blank", "title": "`If-Match` does not match the current `ETag`", "status": 412, "detail": "…", "instance": "/v1/…", "request_id": "9b2f1c1e-8c1a-4a53-9f9e-0f5f1f2d7c11"}The body or query did not validate (validation), or an Idempotency-Key was reused
An RFC 9457 problem details object — the body of every error response. detail is the human-readable explanation; request_id identifies the request for support.
object
about:blank or a urn:tasksmate:problem:* identifier
Human-readable explanation (a string; for a 422, the list of validation errors)
Structured failures: validation errors, or {loc, msg, allowed} for a bad parameter
object
Example
{ "type": "about:blank", "title": "The body or query did not validate (`validation`), or an `Idempotency-Key` was reused", "status": 422, "detail": "…", "instance": "/v1/…", "request_id": "9b2f1c1e-8c1a-4a53-9f9e-0f5f1f2d7c11"}An access token over its per-minute limit (rate-limit; see Retry-After)
An RFC 9457 problem details object — the body of every error response. detail is the human-readable explanation; request_id identifies the request for support.
object
about:blank or a urn:tasksmate:problem:* identifier
Human-readable explanation (a string; for a 422, the list of validation errors)
Structured failures: validation errors, or {loc, msg, allowed} for a bad parameter
object
Example
{ "type": "about:blank", "title": "An access token over its per-minute limit (`rate-limit`; see `Retry-After`)", "status": 429, "detail": "…", "instance": "/v1/…", "request_id": "9b2f1c1e-8c1a-4a53-9f9e-0f5f1f2d7c11"}Unexpected server error — quote request_id
An RFC 9457 problem details object — the body of every error response. detail is the human-readable explanation; request_id identifies the request for support.
object
about:blank or a urn:tasksmate:problem:* identifier
Human-readable explanation (a string; for a 422, the list of validation errors)
Structured failures: validation errors, or {loc, msg, allowed} for a bad parameter
object
Example
{ "type": "about:blank", "title": "Unexpected server error", "status": 500, "detail": "…", "instance": "/v1/…", "request_id": "9b2f1c1e-8c1a-4a53-9f9e-0f5f1f2d7c11"}