Mint Ephemeral User Token

POST/users/{user_id}/tokens

Mints a short-lived token for PII access. Mint, use, discard. Never store it. Requires the token_admin key scope, which on live keys is exclusive: the minting key carries no data scopes and cannot itself use the tokens it mints. Concurrent tokens are allowed. Expiry is the cleanup. Every mint is audit-logged and mint velocity is rate-limited per user. Narrow scopes below the key’s grants per workload, e.g. ["numbers"] for a service that renders masked numbers but must never reveal.

Path Parameters

user_idstringrequired

The Sail user id.

Body application/json

ttl_secondsinteger

How long the minted token remains valid, in seconds.

scopes"identity" | "numbers" | "numbers:reveal"[]

Defaults to all token scopes the minting key’s grants allow. Narrow per workload — omit numbers:reveal for services that only display masked numbers.

Response

Token minted.

user_tokenstring

The minted ephemeral token. Pass it in the x-sail-user-token header.

expires_atstring<date-time>

When the token expires.

scopesstring[]

The token scopes actually granted.

insufficient_key_scope: key lacks token_admin.

rate_limited: mint velocity exceeded for this user.

Standard error envelope covering 400, 401, 403, 404, 429, and 500.

errorobject

The error detail.

Show error properties

codestring

Machine-readable code, e.g. not_found, token_scope_mismatch, product_not_enabled, insufficient_key_scope, insufficient_token_scope, user_token_required, user_token_expired, invalid_user_token, invalid_key_configuration, connection_not_reconnectable, rate_limited.

messagestring

Human-readable error message. May change, so match on error.code instead.

paramstring

The request field that caused the error, when applicable. Null otherwise.

curl -X POST "https://live.savewithsail.com/api/v1/users/<user_id>/tokens" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer <token>" \ -d '{ "ttl_seconds": 900, "scopes": [ "identity" ] }'

const response = await fetch(`https://live.savewithsail.com/api/v1/users/${user_id}/tokens`, { method: 'POST', headers: { 'Content-Type': 'application/json', 'Authorization': 'Bearer <token>' }, body: JSON.stringify({ "ttl_seconds": 900, "scopes": [ "identity" ] }) }); const data = await response.json();

import requests response = requests.request( "POST", "https://live.savewithsail.com/api/v1/users/{user_id}/tokens", headers={ "Authorization": "Bearer <token>" }, json={ "ttl_seconds": 900, "scopes": [ "identity" ] }, ) data = response.json()

<?php $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, "https://live.savewithsail.com/api/v1/users/<user_id>/tokens"); curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "POST"); curl_setopt($ch, CURLOPT_HTTPHEADER, ["Content-Type: application/json", "Authorization: Bearer <token>"]); curl_setopt($ch, CURLOPT_POSTFIELDS, '{ "ttl_seconds": 900, "scopes": [ "identity" ] }'); $response = curl_exec($ch); curl_close($ch);

package main import ( "fmt" "io" "net/http" "strings" ) func main() { req, _ := http.NewRequest("POST", "https://live.savewithsail.com/api/v1/users/<user_id>/tokens", strings.NewReader(`{ "ttl_seconds": 900, "scopes": [ "identity" ] }`)) req.Header.Set("Content-Type", "application/json") req.Header.Set("Authorization", "Bearer <token>") resp, err := http.DefaultClient.Do(req) if err != nil { panic(err) } defer resp.Body.Close() data, _ := io.ReadAll(resp.Body) fmt.Println(string(data)) }

HttpClient client = HttpClient.newHttpClient(); HttpRequest request = HttpRequest.newBuilder() .uri(URI.create("https://live.savewithsail.com/api/v1/users/<user_id>/tokens")) .header("Content-Type", "application/json") .header("Authorization", "Bearer <token>") .method("POST", HttpRequest.BodyPublishers.ofString("{\n \"ttl_seconds\": 900,\n \"scopes\": [\n \"identity\"\n ]\n}")) .build(); HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString()); System.out.println(response.body());

require "net/http" require "uri" uri = URI("https://live.savewithsail.com/api/v1/users/<user_id>/tokens") http = Net::HTTP.new(uri.host, uri.port) http.use_ssl = uri.scheme == "https" request = Net::HTTP::Post.new(uri) request["Content-Type"] = "application/json" request["Authorization"] = "Bearer <token>" request.body = "{\n \"ttl_seconds\": 900,\n \"scopes\": [\n \"identity\"\n ]\n}" response = http.request(request) puts response.body