Skip to main content
POST
Provision a new token

Authorizations

Authorization
string
header
required

The access token received from the authorization server in the OAuth 2.0 flow.

Headers

Idempotency-Key
string<uuid>
required

Client-generated unique key per operation intent (UUID). Same key + identical body replays the original response; same key + different body returns 409.

Body

application/json
type
enum<string>
required
Available options:
RFID,
APP_USER,
AD_HOC_USER,
EMAID,
OTHER
uid
string
required

Caller-supplied, unique within the tenant

Required string length: 1 - 50
contract_id
string
required

Contract or credential identity, e.g. an eMAID

Required string length: 1 - 50
issuer
string
required

Issuer name associated with the credential

Required string length: 1 - 100
whitelist
enum<string>
required

OCPI whitelist policy. Required, no default

Available options:
ALWAYS,
ALLOWED,
ALLOWED_OFFLINE,
NEVER
country_code
string

ISO 3166-1 alpha-2, e.g. DK

Required string length: 2
party_id
string

Party ID of the token owner, e.g. SPI

Required string length: 3
visual_number
string
Required string length: 1 - 64
language
string

Preferred language, e.g. en or da

Required string length: 2 - 10
valid_from
string<date-time>

Defaults to the creation time

valid_until
string<date-time>

Omit for no expiry

metadata
object

Name/value pairs validated against the tenant's active TOKEN metadata schema

emsp_group_ids
string[]

Spirii EMSP token groups to join at provision time. Canonical group ids are opaque strings up to 50 characters, so they are not validated as UUIDs here

Maximum array length: 100
group_id
string

OCPI token group id used in roaming payloads. Unrelated to Spirii EMSP token groups

Required string length: 1 - 50
auto_activate
boolean
default:false

Provision straight into ACTIVE. Whitelist distribution to CPO networks starts in the background, and whitelist_distributed turns true once it completes

Response

The provisioned token

schema_version
enum<string>
required

Canonical schema version

Available options:
v1
id
string
required

Stable internal token id, commonly a UUIDv7

Maximum string length: 64
tenant_id
string
required

Owning tenant, set by the platform

type
enum<string>
required
Available options:
RFID,
APP_USER,
AD_HOC_USER,
EMAID,
OTHER
uid
string
required

Primary credential identifier, unique within the tenant

Maximum string length: 50
contract_id
string
required

Contract or credential identity, e.g. an eMAID

Maximum string length: 50
issuer
string
required

Issuer name associated with the credential

Maximum string length: 100
whitelist
enum<string>
required

OCPI whitelist policy

Available options:
ALWAYS,
ALLOWED,
ALLOWED_OFFLINE,
NEVER
status
enum<string>
required
Available options:
PROVISIONED,
ACTIVE,
SUSPENDED,
EXPIRED,
REVOKED
whitelist_distributed
boolean
required

Whether the token has been distributed to whitelist-capable CPO networks

created_at
string<date-time>
required

When the token was created in the platform registry

last_updated
string<date-time>
required

Canonical publication timestamp propagated to roaming partners

audit
object
required
country_code
string | null
Required string length: 2
party_id
string | null
Required string length: 3
visual_number
string | null
Maximum string length: 64
language
string | null

Preferred language of the token owner

valid_from
string<date-time> | null
valid_until
string<date-time> | null
group_id
string | null

OCPI token group id used in roaming payloads. Unrelated to Spirii EMSP token groups

Maximum string length: 50
emsp_group_id
string | null

Primary Spirii EMSP token group, set at provision time. A convenience only: membership is many-to-many and is managed through POST /emsp/v1/token-groups/{groupId}/tokens

Maximum string length: 50
metadata
object | null

Name/value pairs validated against the tenant's active TOKEN metadata schema

last_authorization
string<date-time> | null
invalidated_at
string<date-time> | null