Kagura AI Resource Tokens API

openapi: 3.2.0
info:
  title: Kagura Memory Cloud Resource Tokens API
  description: Universal AI Memory Platform - Remote MCP Server + Web Management
  version: 0.158.1
tags:
- name: resource-tokens
  description: Resource token management
paths:
  /api/v1/resource-tokens:
    get:
      tags:
      - resource-tokens
      summary: List Resource Tokens
      description: 'List resource tokens with pagination (optionally filtered by resource_id).


        Issue #242: Owner-only access.

        Issue #264: Added pagination support.

        Issue #59: Changed from APIKeyOrSessionUser to WorkspaceOwner.


        Args:

        resource_id: Optional filter by resource_id

        limit: Number of tokens per page (1-100, default 50)

        offset: Starting offset (default 0)

        owner: Workspace owner (user_id, workspace_id) from dependency

        manager: ResourceTokenManager instance


        Returns:

        Paginated response with tokens, total count, limit, and offset'
      operationId: list_resource_tokens_api_v1_resource_tokens_get
      parameters:
      - name: resource_id
        in: query
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: Filter by resource_id
          title: Resource Id
        description: Filter by resource_id
      - name: limit
        in: query
        required: false
        schema:
          type: integer
          maximum: 100
          minimum: 1
          description: Number of tokens per page (max 100)
          default: 50
          title: Limit
        description: Number of tokens per page (max 100)
      - name: offset
        in: query
        required: false
        schema:
          type: integer
          minimum: 0
          description: Starting offset for pagination
          default: 0
          title: Offset
        description: Starting offset for pagination
      - name: authorization
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          title: Authorization
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PaginatedResourceTokensResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
    post:
      tags:
      - resource-tokens
      summary: Create Resource Token
      description: 'Create a new resource token.


        Issue #242: Owner-only access. Returns plaintext token ONLY once.

        Issue #276: Uses WorkspaceOwner dependency for DRY principle.


        The token cap is the WORKSPACE''s (#1919): the count of active,

        non-connector tokens of the workspace — whoever minted them — must be

        under the plan''s ``max_resource_tokens``. It used to be counted per

        creator, while the quota ceiling on PATCH was summed per workspace, so

        two owners could each mint a full set and leave the workspace with no

        quota raise that fitted. The population is the ceiling''s

        (``auth.resource_tokens.workspace_regular_active_tokens``); the sum itself is not checked

        here because count <= cap and quota <= 10000 per token already keep it

        at or under ``max_resource_tokens * 10000``.


        Args:

        data: Token creation request

        owner: Workspace owner (user_id, workspace_id) from dependency

        manager: ResourceTokenManager instance

        db: Database session


        Returns:

        Token metadata + plaintext token (shown ONLY once)


        Raises:

        400: Invalid resource_id

        403: Not workspace owner, plan without the feature, or the workspace

        is at its token cap (``QUOTA-001``)

        500: Failed to create token'
      operationId: create_resource_token_api_v1_resource_tokens_post
      parameters:
      - name: authorization
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          title: Authorization
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ResourceTokenCreate'
      responses:
        '201':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResourceTokenCreateResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /api/v1/resource-tokens/{token_id}:
    patch:
      tags:
      - resource-tokens
      summary: Update Resource Token
      description: 'Update resource token description and/or quota.


        Issue #242: Allow updating token metadata without regenerating.

        Issue #276: Uses WorkspaceOwner dependency for DRY principle.


        The token is the WORKSPACE''s to update (#1863): any owner may relabel any

        token of the workspace, whoever minted it. It is resolved with the same

        predicate the list and the quota ceiling use (#1919,

        ``auth.resource_tokens.workspace_tokens`` — the ``resources`` row its

        ``resource_pk`` points at, or its own

        ``workspace_id`` for a legacy row without one), so a token the ceiling

        counts is always addressable; it used to be matched on the shadow

        ``workspace_id`` column alone and was a 404 when that was never

        backfilled. A quota raise is checked against the workspace''s ceiling,

        ``max_resource_tokens * 10000`` events/hour over the workspace''s active

        non-connector tokens; a lowering is never refused.


        Args:

        token_id: Public id of the token (``rtok_...``)

        request: Update request

        owner: Workspace owner (user_id, workspace_id) from dependency

        db: Database session


        Returns:

        Updated token metadata


        Raises:

        400: The quota raise does not fit the workspace''s ceiling

        403: Not workspace owner

        404: Token not found (or not this workspace''s — the same answer)'
      operationId: update_resource_token_api_v1_resource_tokens__token_id__patch
      parameters:
      - name: token_id
        in: path
        required: true
        schema:
          type: string
          pattern: ^rtok_[0-9A-Za-z]{22}$
          description: Public id of the resource token (`rtok_` + 22 base62 characters).
          examples:
          - rtok_0000000000000000000000
          title: Token Id
        description: Public id of the resource token (`rtok_` + 22 base62 characters).
      - name: authorization
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          title: Authorization
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ResourceTokenUpdate'
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResourceTokenResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
    delete:
      tags:
      - resource-tokens
      summary: Revoke Resource Token
      description: 'Revoke a resource token (soft delete).


        Issue #242: Owner-only access. Sets is_active=False (preserves audit trail).

        Issue #276: Uses WorkspaceOwner dependency for DRY principle.


        The token is the WORKSPACE''s to revoke (#1863): any owner may revoke any

        token of the workspace, including one minted by a departed member or a

        connector. It is resolved like the list, the update route and the quota

        ceiling (#1919, ``auth.resource_tokens.workspace_tokens``): by the ``resources`` row its

        ``resource_pk`` points at — so a token whose contexts were deleted, or

        whose shadow ``workspace_id`` was never backfilled, can still be revoked

        while it still authenticates ingest.


        Args:

        token_id: Public id of the token to revoke (``rtok_...``)

        owner: Workspace owner (user_id, workspace_id) from dependency

        manager: ResourceTokenManager instance

        db: Database session


        Raises:

        403: Not workspace owner

        404: Token not found (or not this workspace''s — the same answer)

        500: Failed to revoke token'
      operationId: revoke_resource_token_api_v1_resource_tokens__token_id__delete
      parameters:
      - name: token_id
        in: path
        required: true
        schema:
          type: string
          pattern: ^rtok_[0-9A-Za-z]{22}$
          description: Public id of the resource token (`rtok_` + 22 base62 characters).
          examples:
          - rtok_0000000000000000000000
          title: Token Id
        description: Public id of the resource token (`rtok_` + 22 base62 characters).
      - name: authorization
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          title: Authorization
      responses:
        '204':
          description: Successful Response
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
components:
  schemas:
    ResourceTokenCreateResponse:
      properties:
        id:
          title: Id
          description: Public id of the token (`rtok_` + 22 base62 characters)
        resource_id:
          title: Resource Id
          description: Resource identifier
        description:
          title: Description
          description: Human-readable description
        quota_events_per_hour:
          title: Quota Events Per Hour
          description: Event ingestion quota per hour
        created_by:
          title: Created By
          description: User ID who created this token
        created_at:
          title: Created At
          description: Creation timestamp
        last_used_at:
          title: Last Used At
          description: Last usage timestamp
        is_active:
          title: Is Active
          description: Whether token is active
        status:
          title: Status
          description: Current status
        token:
          title: Token
          description: Plaintext resource token (ONLY shown once - must be saved by client)
      type: object
      required:
      - id
      - resource_id
      - quota_events_per_hour
      - created_at
      - is_active
      - status
      - token
      title: ResourceTokenCreateResponse
      description: 'Response model for resource token creation (includes plaintext token).


        WARNING: The `token` field is shown ONLY once. Client must save it immediately.'
    ResourceTokenUpdate:
      properties:
        description:
          anyOf:
          - type: string
            maxLength: 500
          - type: 'null'
          title: Description
          description: Updated description
        quota_events_per_hour:
          anyOf:
          - type: integer
            maximum: 10000.0
            minimum: 1.0
          - type: 'null'
          title: Quota Events Per Hour
          description: Updated quota (1-10000)
      type: object
      title: ResourceTokenUpdate
      description: Request model for updating a resource token.
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          type: array
          title: Detail
      type: object
      title: HTTPValidationError
    ValidationError:
      properties:
        loc:
          items:
            anyOf:
            - type: string
            - type: integer
          type: array
          title: Location
        msg:
          type: string
          title: Message
        type:
          type: string
          title: Error Type
        input:
          title: Input
        ctx:
          type: object
          title: Context
      type: object
      required:
      - loc
      - msg
      - type
      title: ValidationError
    ResourceTokenCreate:
      properties:
        resource_id:
          type: string
          maxLength: 255
          minLength: 1
          title: Resource Id
          description: Resource identifier this token is scoped to
        description:
          anyOf:
          - type: string
            maxLength: 500
          - type: 'null'
          title: Description
          description: Human-readable description
        quota_events_per_hour:
          type: integer
          maximum: 10000.0
          minimum: 1.0
          title: Quota Events Per Hour
          description: 'Event ingestion quota per hour (default: 1000)'
          default: 1000
      type: object
      required:
      - resource_id
      title: ResourceTokenCreate
      description: Request model for creating a resource token.
    ResourceTokenResponse:
      properties:
        id:
          title: Id
          description: Public id of the token (`rtok_` + 22 base62 characters)
        resource_id:
          title: Resource Id
          description: Resource identifier
        description:
          title: Description
          description: Human-readable description
        quota_events_per_hour:
          title: Quota Events Per Hour
          description: Event ingestion quota per hour
        created_by:
          title: Created By
          description: User ID who created this token
        created_at:
          title: Created At
          description: Creation timestamp
        last_used_at:
          title: Last Used At
          description: Last usage timestamp
        is_active:
          title: Is Active
          description: Whether token is active
        status:
          title: Status
          description: Current status
      type: object
      required:
      - id
      - resource_id
      - quota_events_per_hour
      - created_at
      - is_active
      - status
      title: ResourceTokenResponse
      description: Response model for resource token metadata (no plaintext).
    PaginatedResourceTokensResponse:
      properties:
        tokens:
          items:
            $ref: '#/components/schemas/ResourceTokenResponse'
          type: array
          title: Tokens
          description: List of resource tokens
        total:
          type: integer
          title: Total
          description: Total number of tokens matching filter
        limit:
          type: integer
          title: Limit
          description: Number of tokens per page
        offset:
          type: integer
          title: Offset
          description: Starting offset
      type: object
      required:
      - tokens
      - total
      - limit
      - offset
      title: PaginatedResourceTokensResponse
      description: 'Paginated response for resource tokens.


        Issue #264: Pagination support for large token lists.'