> ## Documentation Index > Fetch the complete documentation index at: https://docs.startree.ai/llms.txt > Use this file to discover all available pages before exploring further. # Create a service token > Creates a service token and returns its access key, secret key, and the full bearer token (`st--`). Save the secret key and bearer token from this response: they cannot be retrieved again. A new token has no permissions. Assign it a role with `POST /roles/{roleSrn}/create-assignment`, using `subjectType: service-token` and the access key as the `subject`. ## OpenAPI ````yaml api-reference/rbac/openapi.yaml POST /service-tokens openapi: 3.0.3 info: title: StarTree RBAC Manager API description: > Manage role-based access control (RBAC) in StarTree Cloud: policies, roles, the policies attached to each role, the subjects (users, groups, domains, service tokens) assigned to each role, and service tokens. Every request needs an `Authorization: Bearer ` header. See [Generating an API Token](/corecapabilities/security/manage-api-tokens#generating-an-api-token). Resources are identified by StarTree Resource Names (SRNs), for example `srn2:policy#my-policy` or `srn2:role#table-reader`. When an SRN appears in a URL path, encode the `#` as `%23` (`/policies/srn2:policy%23my-policy`). For a guided walkthrough of these endpoints, see [Using the RBAC API](/corecapabilities/security/using-rbac-api). version: '1.0' servers: - url: '{baseUrl}/api/v1/rbac-manager' variables: baseUrl: default: https://rbac-manager.your-env.startree.cloud description: >- RBAC Manager URL of your StarTree Cloud environment without a trailing slash, e.g. https://rbac-manager..startree.cloud security: - bearerAuth: [] tags: - name: Policies description: >- Create, list, update, and delete policies. A policy document says which actions are allowed or denied on which resources. - name: Roles description: >- Create, list, update, and delete roles. A role groups one or more policies. - name: Role policies description: Attach policies to roles and inspect what a role grants. - name: Role assignments description: Grant a role to users, groups, email domains, or service tokens. - name: Service tokens description: >- Bearer tokens for programmatic access. A token is unusable until it is assigned a role. - name: Access simulation description: >- Check what a subject would be allowed to do, before or after saving a policy. paths: /service-tokens: post: tags: - Service tokens summary: Create a service token description: > Creates a service token and returns its access key, secret key, and the full bearer token (`st--`). Save the secret key and bearer token from this response: they cannot be retrieved again. A new token has no permissions. Assign it a role with `POST /roles/{roleSrn}/create-assignment`, using `subjectType: service-token` and the access key as the `subject`. operationId: createServiceToken requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/CreateServiceTokenRequest' responses: '200': description: The new token, including its secret key. content: application/json: schema: $ref: '#/components/schemas/CreateServiceTokenResponse' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' components: schemas: CreateServiceTokenRequest: type: object properties: description: type: string example: CI pipeline token for nightly ingestion CreateServiceTokenResponse: allOf: - type: object properties: srn: type: string example: srn2:service-token#a1B2c3D4e5F6g7H8 description: type: string example: CI pipeline token for nightly ingestion accessKey: type: string description: >- Public identifier of the token. Use it as the `subject` when assigning a role. example: a1B2c3D4e5F6g7H8 secretKey: type: string description: Returned only in this response. bearerToken: type: string description: >- The full token to send in the `Authorization` header, formatted `st--`. Returned only in this response. ttl: type: integer format: int64 nullable: true description: Time to live in seconds, or null if the token does not expire. - $ref: '#/components/schemas/AuditFields' AuditFields: type: object properties: createdAt: type: string format: date-time example: '2024-09-04T00:28:30.876+00:00' lastUpdatedAt: type: string format: date-time example: '2024-09-04T00:28:30.876+00:00' createdBy: type: string description: >- SRN of the principal that created the resource. Predefined StarTree resources show `startree-rbac-manager`. example: srn:zone:user:default:abcd1234 lastUpdatedBy: type: string example: srn:zone:user:default:abcd1234 Error: type: object properties: timestamp: type: string format: date-time status: type: integer example: 404 error: type: string example: Not Found message: type: string example: Not Found. path: type: string example: /api/v1/rbac-manager/policies/srn2:policy%23missing responses: Unauthorized: description: Missing or invalid bearer token. content: application/json: schema: $ref: '#/components/schemas/Error' Forbidden: description: The caller's roles do not allow this RBAC operation. content: application/json: schema: $ref: '#/components/schemas/Error' securitySchemes: bearerAuth: type: http scheme: bearer description: A StarTree API token or a service token (`st--`). ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.