Issue a machine credential

POST

/api/machine-clients/issue

Maintainer:Not configured

OperationId:issue_machine_credential

Mints a new machine principal with a temper-issued client_id and secret. The client_secret in the response is shown once and never stored; only its hash is kept, so it cannot be retrieved later. Requires a system admin (only its owner, on someone else's personal team) or the owner of owner_team_id; a machine with no owning team can only be issued by a system admin. A team owner can confer only reach they could grant themselves, and a cogmap grant only on a map where they hold the grant right in their own name (on their profile or their own personal team), not through a shared team. No caller can give a machine a team role above member. Where an external identity provider mints this instance's tokens, the credential is returned with dormant: true: it authenticates once the instance runs temper's own authorization server.

Request

Authorization

JWT Bearer

Add the parameter

Authorization

to Headers

Example:

Authorization: ********************

Header Params

Body Params application/jsonRequired

Examples

Responses

🟢200OK

application/json

The new machine client and its one-time client_secret

Bodyapplication/json

🟠400Bad Request

🟠401Unauthorized

🟠403Forbidden

Request Example

Shell

JavaScript

Java

Swift

curl --location '/api/machine-clients/issue' \
--header 'X-Temper-Surface;' \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '{
    "grants": [
        {
            "can_write": true,
            "cogmap_id": "b2008c45-9f31-4aae-8f49-0cadcb6ad25e"
        }
    ],
    "label": "string",
    "owner_team_id": "5f2e83f0-a87c-4d3f-b3e5-3bbc66dabe7e",
    "teams": [
        {
            "role": "string",
            "team_id": "810007d0-bec5-486c-b5d1-28fcd8a079ba"
        }
    ]
}'

Response Example

200 - Example 1

{
    "client": {
        "client_id": "string",
        "created": "2019-08-24T14:15:22.123Z",
        "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
        "issuer": "string",
        "label": "string",
        "last_seen_at": "2019-08-24T14:15:22.123Z",
        "profile_id": "bfcb6779-b1f9-41fc-92d7-88f8bc1d12e8",
        "registered_by_profile_id": "18e6908a-ccb7-48bf-a180-a379e0568e01",
        "revoked_at": "2019-08-24T14:15:22.123Z",
        "revoked_by_profile_id": "e2512452-9e5c-40a6-8117-21bb43a829e4",
        "secret_rotated_by_profile_id": "d73cae19-470b-43f5-9688-cb1abc10cb63",
        "team_id": "810007d0-bec5-486c-b5d1-28fcd8a079ba"
    },
    "client_secret": "string",
    "dormant": true
}

Modified at 2026-11-01 22:41:39

Get a machine client