Workspace API tokens

Token format

An Axos workspace API token is a 44-character string prefixed with axws_LIVE_. The body is Base32-encoded random data. Tokens are stored hashed with argon2id; the plaintext is only ever shown once, at creation time.

Creating a token

From /api-tokens or via the workspace API itself:

curl -X POST https://api.axoshub.org/v1/tokens \
  -H "Authorization: Bearer <existing_admin_token>" \
  -d '{"name":"Weekly export","scopes":["notes:read","tasks:read"],"lifetime_days":90}'

Available scopes

• notes:read, notes:write
• tasks:read, tasks:write
• calendar:read, calendar:write
• workspace:admin (for token and seat management)

Endpoints

Method	Path	Purpose
GET	/v1/notes	List notes (paginated 100/page)
GET	/v1/notes/{id}	Fetch note by ID
POST	/v1/notes	Create note
PATCH	/v1/notes/{id}	Update note
DELETE	/v1/notes/{id}	Delete note
GET	/v1/tasks	List tasks
POST	/v1/tasks	Create task
GET	/v1/calendar	List calendar events
POST	/v1/calendar	Create calendar event
POST	/v1/exports	Trigger a full workspace export ZIP

Rate limits

600 requests per minute per token. Exceeded requests receive HTTP 429 with a Retry-After header expressed in seconds.

Error codes

401 invalid or revoked token. 403 valid token, insufficient scope. 404 object does not belong to the workspace bound to the token. 422 validation error, body contains structured field errors. 429 rate limit exceeded. 500 unexpected server error, surface the incident ID from the response header.

Rotation

Rotation is an atomic operation: a new plaintext is generated, the old plaintext is invalidated on the next request. Zero-downtime rotation requires the caller to accept both plaintexts during the rotation window.