Access listing and revocation require owner/admin membership. Creation validates requested scopes against the human’s current permission ceiling and every selected project. It cannot grant access the creator lacks.
API credential input
name is a nonempty string of up to 100 characters. scopes must contain supported scopes within current access. projectIds is null for unrestricted project access or an array of 1 to 100 project IDs in this workspace. Project-restricted access cannot request projects:write. expiresInDays is an integer from 1 to 90, default 30.
The response contains id, token, name, scopes, projectIds and expires_at. The full token is returned once. Access listings expose metadata such as prefix, scopes_json, project_ids_json, created_at, expires_at and revoked_at; they do not recover a token.
For normal cloud work, use the HTTP command interface. Members, invitations and access changes have shared command pages. Creating an invitation does not authorize sending an email automatically.
Reference follows the current development CLI and HTTP contracts. Hosted availability depends on the selected environment. See capability status.