> ## Documentation Index > Fetch the complete documentation index at: https://developers.askparable.com/llms.txt > Use this file to discover all available pages before exploring further. # Create an ingestion token > Creates the ingestion token of one Tap in this Workspace that receives data sent to Parable. The response holds the token and the endpoint URL that carries it. They are returned once only, so store them at once. A Tap has one live token at a time. To replace it, rotate it. Requires permission to change the Workspace's Taps. ## Access This operation needs a Parable token. An MCP token cannot call it. See [Authentication](/getting-started/authentication.md) for the kinds of token. Your roles must grant `tenant.connectors.taps.write`. ## Errors * `WA-IGT-002`: The Tap is not in this Workspace. Choose a Tap from the selected Workspace. * `WA-IGT-003`: The Tap already has a live ingestion token. Rotate the live token instead. ## OpenAPI ````yaml /api-reference/openapi.json post /api/ingest-tokens openapi: 3.0.3 info: description: >- Use the Workspace API to work with artifacts, connectors, Parables, and account resources. title: Workspace API version: v2026.10.22.1 servers: [] security: [] paths: /api/ingest-tokens: post: tags: - Ingest tokens summary: Create an ingestion token description: >- Creates the ingestion token of one Tap in this Workspace that receives data sent to Parable. The response holds the token and the endpoint URL that carries it. They are returned once only, so store them at once. A Tap has one live token at a time. To replace it, rotate it. Requires permission to change the Workspace's Taps. operationId: IngestTokensMintIngestTokenHandler parameters: - description: >- Workspace slug. Overrides subdomain-based workspace resolution when provided. in: header name: X-Tenant required: false schema: example: acme type: string - description: Optional request correlation ID echoed back in the response. in: header name: X-Request-ID required: false schema: example: 550e8400-e29b-41d4-a716-446655440000 format: uuid type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/MintIngestTokenInput' required: true responses: '200': content: application/json: schema: properties: data: $ref: '#/components/schemas/MintIngestTokenResult' links: $ref: '#/components/schemas/ResponseLinks' meta: $ref: '#/components/schemas/ResponseMeta' required: - data - meta type: object description: Successful response headers: X-Request-ID: $ref: '#/components/headers/X-Request-ID' '400': content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' description: >- The request is not valid. `detail` says why. A value that breaks a field rule gives the code `WA-VL-001` and an `errors` member that names each field. headers: X-Request-ID: $ref: '#/components/headers/X-Request-ID' '401': content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' description: The token is missing, malformed, revoked, or expired. headers: X-Request-ID: $ref: '#/components/headers/X-Request-ID' '403': content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' description: >- The token cannot make this request. For example, the roles of its owner do not allow the operation. headers: X-Request-ID: $ref: '#/components/headers/X-Request-ID' '500': content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' description: The request failed on the server. headers: X-Request-ID: $ref: '#/components/headers/X-Request-ID' security: - bearerAuth: [] x-codeSamples: - label: TypeScript SDK lang: typescript source: >- import { WebApiSDK } from "@parable-platform/web-api-sdk"; import type { MintIngestTokenInput } from "@parable-platform/web-api-types"; const sdk = new WebApiSDK({ baseUrl: process.env.PARABLE_API_URL!, auth: { token: process.env.PARABLE_API_TOKEN! }, requestInterceptor: (config) => ({ ...config, headers: { ...config.headers, "X-Tenant": process.env.PARABLE_WORKSPACE! }, }), }); const input: MintIngestTokenInput = JSON.parse(`{ "tenantConnectorTapId": "example" }`); const result = await sdk.ingestTokens.mintIngestToken( input ); - label: Python SDK lang: python source: |- import json import os from parable_types_web_api import MintIngestTokenInput from parable_web_api_sdk import ClientConfig, WebApiSDK sdk = WebApiSDK( ClientConfig( base_url=os.environ["PARABLE_API_URL"], auth_token=os.environ["PARABLE_API_TOKEN"], default_headers={"X-Tenant": os.environ["PARABLE_WORKSPACE"]}, ) ) input_data = MintIngestTokenInput.model_validate( json.loads("{\"tenantConnectorTapId\":\"example\"}"), ) result = sdk.ingest_tokens.mint_ingest_token(input_data) - label: Rust SDK lang: rust source: >- use parable_web_api_sdk::{types, ClientConfig, RequestOptions, WebApiSdk}; let sdk = WebApiSdk::new(ClientConfig::with_base_url( std::env::var("PARABLE_API_URL")?, Some(std::env::var("PARABLE_API_TOKEN")?), None, ))?; let options = RequestOptions::with_header("X-Tenant", std::env::var("PARABLE_WORKSPACE")?, None, None); let input: types::MintIngestTokenInput = serde_json::from_value( serde_json::json!({ "tenantConnectorTapId": "example" }), )?; let result = sdk.ingest_tokens.mint_ingest_token( input, Some(&options) ).await?; - label: Go SDK lang: go source: "sdk, err := webapisdk.New(webapisdk.SDKConfig{\n\tBaseURL: os.Getenv(\"PARABLE_API_URL\"),\n\tAuth: &webapisdk.AuthConfig{Token: os.Getenv(\"PARABLE_API_TOKEN\")},\n\tRequestInterceptor: func(ctx context.Context, req *http.Request) error {\n\t\treq.Header.Set(\"X-Tenant\", os.Getenv(\"PARABLE_WORKSPACE\"))\n\t\treturn nil\n\t},\n})\nif err != nil {\n\treturn err\n}\n\nvar input webapitypes.MintIngestTokenInput\nif err := json.Unmarshal([]byte(`{\"tenantConnectorTapId\":\"example\"}`), &input); err != nil {\n\treturn err\n}\nresult, err := sdk.IngestTokensNamespace.MintIngestToken(ctx, input)" components: schemas: MintIngestTokenInput: description: |- Input for minting a new ingest token. The tap must belong to the calling workspace; the service layer enforces this before minting. properties: tenantConnectorTapId: description: The collector provider connection this token routes to. pattern: >- ^([0-9A-Za-z]{1,22}|[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$ type: string required: - tenantConnectorTapId type: object MintIngestTokenResult: description: >- Result of mintIngestToken and rotateIngestToken. The plaintext `token` is returned exactly once and is irrecoverable afterwards — clients must surface it (and the endpointUrl embedding it) to the user immediately and never re-fetch. properties: endpointUrl: description: >- Full ingest endpoint URL embedding the token, ready to paste into a vendor console or sender config (e.g. https://incoming.parable.work/v1/{token}). Shown once alongside the token. type: string ingestToken: $ref: '#/components/schemas/IngestTokenInfo' token: description: One-time plaintext token (base62). Persist nowhere. type: string required: - ingestToken - token - endpointUrl type: object ResponseLinks: properties: first: nullable: true type: string last: nullable: true type: string next: nullable: true type: string prev: nullable: true type: string type: object ResponseMeta: properties: requestId: description: Unique identifier for the request type: string totalCount: description: Total count of items for paginated responses nullable: true type: integer required: - requestId type: object ProblemDetails: description: An error response in the Problem Details format (RFC 9457). properties: code: description: The stable error code, when the problem has one. example: WA-VL-001 type: string detail: description: What went wrong with this request. type: string details: description: >- Structured facts about the refusal, such as the entity or the path it concerns. Only some refusals have it. errors: description: >- The fields or filters that failed validation. Only a validation or filter error has it. requestId: description: >- The ID of the request, when the problem has one. The `X-Request-ID` response header always has it. type: string status: description: The HTTP status code. example: 400 type: integer title: description: A short summary, usually the text of the HTTP status. example: Bad Request type: string type: description: >- The problem type. It is `about:blank`: the status and `code` identify the problem. example: about:blank type: string required: - type - title - status - detail type: object IngestTokenInfo: description: >- An ingest token belonging to one of the workspace's collector taps. Its hash is never returned. The plaintext is returned once only, when the token is created or rotated, in MintIngestTokenResult.token. After that, the prefix is the only identifier you can see. A token with revokedAt set is refused within a short cache delay. A token whose expiresAt has passed is refused: its rotation grace period is over. properties: createdAt: description: >- ISO8601 datetime string. Epoch wire values keep this scalar and declare x-temporal-format (unix, unix_millis, unix_micros, unix_nanos) on the property; the unit is never guessed from digit count. format: date-time type: string expiresAt: description: >- Rotation grace expiry. Set on the outgoing token when a rotation mints its replacement; after expiresAt the token is rejected. Null = no expiry. format: date-time nullable: true type: string id: description: UUID v4 with automatic base62 encoding for client-facing APIs pattern: >- ^([0-9A-Za-z]{1,22}|[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$ type: string lastUsedAt: description: >- ISO8601 datetime string. Epoch wire values keep this scalar and declare x-temporal-format (unix, unix_millis, unix_micros, unix_nanos) on the property; the unit is never guessed from digit count. format: date-time nullable: true type: string prefix: description: >- First characters of the plaintext token, shown in lists so the workspace can identify which token is which. type: string revokedAt: description: >- Set when the token was revoked. Revoked tokens are kept for audit but immediately rejected. format: date-time nullable: true type: string rotatedAt: description: Set when the token was rotated (a replacement row was minted). format: date-time nullable: true type: string tenantConnectorTapId: description: Flattened Relation for the wire. pattern: >- ^([0-9A-Za-z]{1,22}|[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$ type: string updatedAt: description: >- ISO8601 datetime string. Epoch wire values keep this scalar and declare x-temporal-format (unix, unix_millis, unix_micros, unix_nanos) on the property; the unit is never guessed from digit count. format: date-time type: string required: - id - createdAt - updatedAt - tenantConnectorTapId - prefix type: object headers: X-Request-ID: description: >- The ID of the request. It is the `X-Request-ID` value that you sent, or an ID that the server made. Give it when you report a problem. schema: type: string securitySchemes: bearerAuth: description: >- A personal access token, which starts with `pat_`. A Parable token can call each operation that the roles of its owner allow. An MCP token can call only the read operations that are open to agents. A SQL token does not work on this API. scheme: bearer type: http ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.