# `Wardrik.Tokens`

Operations on the deployment's API tokens. People and programs use them to reach Wardrik over
HTTP.

    Wardrik.Tokens.create(scope, name: "ci", roles: ["reader"], resources: ["acme/agent/*"])
    #=> {:ok, %Wardrik.TokenIssued{token: %Wardrik.Token{id: "3f9a61c0d4e2", ...}, secret: "wrk_3f9a61c0d4e2_9c1e..."}}

    # The secret is returned once. Turn it back into a scope with:
    {:ok, ci} = MyApp.AgentRuntime.authenticate("wrk_3f9a61c0d4e2_9c1e...")

# `create`

```elixir
@spec create(Wardrik.Scope.t(), term()) :: term() | :ok | {:error, Wardrik.Error.t()}
```

Make an API token

The token acts for whoever makes it, and is kept as the SHA-256 of its secret. It works for 90 days, or expires_in seconds. It is no wider than its maker: each action its roles allow, on each resource it names, is one its maker may take there; it is held to its maker's policy where its maker is held to one; and it expires no later than its maker does.

`POST /v1/tokens`

# `list`

```elixir
@spec list(Wardrik.Scope.t(), term()) :: term() | :ok | {:error, Wardrik.Error.t()}
```

List the API tokens

Every token, oldest first, never a secret. With resources, only the tokens whose every resource the patterns cover, as acme/agent/* lists the tokens over acme's agents alone.

`GET /v1/tokens`

# `revoke`

```elixir
@spec revoke(Wardrik.Scope.t(), String.t() | struct(), term()) ::
  term() | :ok | {:error, Wardrik.Error.t()}
```

Revoke an API token

A revoked token is refused at once. An agent it defined keeps running, under the policy it was defined with.

`DELETE /v1/tokens/{token}`

---

*Consult [api-reference.md](api-reference.md) for complete listing*