Skip to content

Mint Mcu Access Token

POST
/api/auth/mcu/token

Mint a short-lived mcu_access ES256 token for the caller.

The caller must be an actual OrganizationMember of the target organization — deliberately NOT extending this backend’s usual superuser-bypasses-membership-checks convention (see app.core.deps.OrganizationAccess) here: a superuser with no membership row has no SoC role to federate, and MCU-Server’s MapSocRole() has no entry for “no role at all” beyond its own default-to-read_only, which would silently under- or over-grant rather than fail loudly.

Authorizations

Request Body required

Request body for POST /api/auth/mcu/token.

organization_id is optional — omit it to federate into the caller’s primary (first-created) organization membership, the same default app.core.auth_helpers.get_primary_organization_id uses for the native login JWT’s org_id claim. Pass it explicitly to federate into a different organization the caller is a member of.

object
organization_id
Any of:
string format: uuid

Responses

200

Successful Response

Response body for POST /api/auth/mcu/token.

object
expires_in
required
integer
mcu_access_token
required
string
organization_id
required
string format: uuid
token_type
string
default: bearer

422

Validation Error

object
detail
Array<object>
object
loc
required
Array
msg
required
string
type
required
string