Skip to content
Vinosoft2026-04-01
en/de
API reference navigation

Access Tokens

Admin

Access Tokens groups 3 operations on the admin tier.

Admin tier. Requires an RBAC-gated vnstat_ access token, sent as Authorization: Bearer … or X-Vinosoft-Access-Token.

GET

/api/{version}/admin/access_tokens

All active (non-revoked) tokens for the tenant, newest first. Unpaged, and never exposes secrets: a row carries only the tier prefix.

AuthenticationToken requiredAdmin tier. Requires an RBAC-gated vnstat_ access token, sent as Authorization: Bearer … or X-Vinosoft-Access-Token.

Responses

curl -X GET \
  'https://<your-shop-domain>/api/2026-04-01/admin/access_tokens' \
  -H 'Accept: application/json' \
  -H 'Authorization: Bearer vnstat_<token>'
Response200example shape
{
  "access_tokens": [
    {
      "id": "00000000-0000-0000-0000-000000000000",
      "prefix": "string",
      "label": "string",
      "scopes": "string",
      "created_at": "2026-04-01T12:00:00Z",
      "last_used_at": "2026-04-01T12:00:00Z"
    }
  ]
}
POST

/api/{version}/admin/access_tokens

Mint a token for the current tenant, issued by the signed-in user. The plaintext secret is in the response once and never retrievable again (only its hashes are stored); no other endpoint in this API ever returns it. A missing body, a blank label, an unrecognized tier and a scope the tier does not allow are all 422.

AuthenticationToken requiredAdmin tier. Requires an RBAC-gated vnstat_ access token, sent as Authorization: Bearer … or X-Vinosoft-Access-Token.

Request body

application/json, text/json, application/*+json · optional

CreateAccessTokenRequest

Body for POST /api/{version}/admin/access_tokens.

  • labelstringnullable
  • tierstringnullable
  • scopesstring[]nullable

Responses

curl -X POST \
  'https://<your-shop-domain>/api/2026-04-01/admin/access_tokens' \
  -H 'Accept: application/json' \
  -H 'Authorization: Bearer vnstat_<token>' \
  -H 'Content-Type: application/json' \
  -d '{
  "label": "string",
  "tier": "string",
  "scopes": [
    "string"
  ]
}'
Response201example shape
{
  "access_token": {
    "id": "00000000-0000-0000-0000-000000000000",
    "token": "string",
    "prefix": "string",
    "label": "string",
    "scopes": "string"
  }
}
DELETE

/api/{version}/admin/access_tokens/{id}

Revoke a token. Returns 204 with no body. Tenant-scoped — one shop cannot revoke another's token, and an already-revoked or foreign id is a 404.

AuthenticationToken requiredAdmin tier. Requires an RBAC-gated vnstat_ access token, sent as Authorization: Bearer … or X-Vinosoft-Access-Token.

Path parameters

NameTypeDescription
id
required
string (uuid)

Responses

curl -X DELETE \
  'https://<your-shop-domain>/api/2026-04-01/admin/access_tokens/<id>' \
  -H 'Accept: application/json' \
  -H 'Authorization: Bearer vnstat_<token>'

Schemas

AccessTokenDto

A stored access token as the list read exposes it. Carries no secret and no way to derive one — see Cloudwawi.Shop.Api.V2026_04_01.MintedAccessTokenDto.Token.

  • idstring (uuid)
  • prefixstringnullable

    Tier prefix (vnstat or vnstss). Not enough to reconstruct the token.

  • labelstringnullable
  • scopesstringnullable

    The granted scopes, space-delimited — see Cloudwawi.Shop.Api.V2026_04_01.MintedAccessTokenDto.Scopes.

  • created_atstring (date-time)

    When the token was minted (UTC).

  • last_used_atstring (date-time)nullable

    When the token last authenticated a request (UTC), or null if it never has. An always-present key — a never-used token sends an explicit null.

AccessTokenListResponse

Envelope returned by GET /admin/access_tokens. Unpaged: there is no Link header and no page_info — a tenant holds few tokens and all of them are returned.

  • access_tokensAccessTokenDto[]nullable

    The tenant's active tokens, newest first. Revoked tokens are not listed. Always present; an empty array when none have been minted. No entry carries a secret.

ApiErrorResponse

The error envelope every non-2xx response from this API uses. Documentation shape: actions build it as an anonymous object, so this type exists to give the OpenAPI document a schema to point at.

  • errorsstringnullable

    Human-readable description of what went wrong, e.g. Not Found, Invalid page_info.

  • codestringnullable

    Machine-readable error code. Only a few endpoints (checkout) emit one; omitted everywhere else.

CreateAccessTokenRequest

Body for POST /api/{version}/admin/access_tokens.

  • labelstringnullable
  • tierstringnullable
  • scopesstring[]nullable

MintedAccessTokenDto

A freshly minted access token — the only representation that carries the secret. Returned by POST /admin/access_tokens and by nothing else.

  • idstring (uuid)

    The token record's id. This is what DELETE /admin/access_tokens/{id} takes.

  • tokenstringnullable

    The plaintext secret, in the form vnstat_… (admin tier) or vnstss_… (storefront tier). Shown once. Only its hashes are stored, so this value is not retrievable from any later call — a lost token can only be replaced by minting a new one and revoking this one.

  • prefixstringnullable

    The token's tier prefix (vnstat or vnstss) — the leading segment of Cloudwawi.Shop.Api.V2026_04_01.MintedAccessTokenDto.Token, and the only part of it the list read echoes back.

  • labelstringnullable

    The label supplied on create, trimmed.

  • scopesstringnullable

    The granted scopes as a single space-delimited string, not an array — admin tokens carry Cloudwawi.Shop/<resource>/<action> permissions, storefront tokens the fixed storefront/* capabilities. This is the grant as stored, which is what was requested; the authority actually exercised at request time is further narrowed against the issuing user's live CRM permissions, so a token can never do more than its issuer can.

MintedAccessTokenResponse

Envelope returned by POST /admin/access_tokens (201).