{"command":{"effect":"write","timeoutSeconds":30,"inputSchema":{"type":"object","description":"Generates a new service token. **Note:** This is the only time you can get the Client Secret. If you lose the Client Secret, you will have to rotate the Client Secret or create a new service token.","properties":{"path":{"type":"object","properties":{"account_id":{"$ref":"#/definitions/access_identifier"}},"required":["account_id"],"additionalProperties":false},"body":{"type":"object","properties":{"client_secret_version":{"$ref":"#/definitions/access_client_secret_version"},"duration":{"$ref":"#/definitions/access_duration"},"enabled":{"$ref":"#/definitions/access_enabled"},"name":{"$ref":"#/definitions/access_name-2"},"previous_client_secret_expires_at":{"$ref":"#/definitions/access_previous_client_secret_expires_at"},"tags":{"$ref":"#/definitions/access_tags"}},"required":["name"]}},"required":["path","body"],"additionalProperties":false,"definitions":{"access_identifier":{"description":"Identifier.","type":"string","maxLength":32,"examples":["023e105f4ecef8ad9ca31a8372d0c353"]},"access_client_secret_version":{"description":"A version number identifying the current `client_secret` associated with the service token. Incrementing it triggers a rotation; the previous secret will still be accepted until the time indicated by `previous_client_secret_expires_at`. If the service token was reported as leaked, `previous_client_secret_expires_at` is not required, may not be in the future, and the previous secret is discarded immediately.","type":"number","default":1},"access_duration":{"description":"The duration for how long the service token will be valid. Must be in the format `300ms` or `2h45m`, or the special value `forever` for non-expiring tokens. Valid time units are: ns, us (or µs), ms, s, m, h. The default is 1 year in hours (8760h).","type":"string","default":"8760h","examples":["60m"]},"access_enabled":{"description":"Whether the service token is enabled. A disabled service token cannot be used to authenticate; both its current and previous `client_secret` stop being accepted, but the token itself is preserved and can be re-enabled. A service token reported as leaked is disabled automatically and cannot be re-enabled until its secret is rotated; attempting to do so returns a 409. Defaults to enabled when omitted on create.","type":"boolean"},"access_name-2":{"description":"The name of the service token.","type":"string","examples":["CI/CD token"]},"access_previous_client_secret_expires_at":{"description":"The expiration of the previous `client_secret`. This can be modified at any point after a rotation. For example, you may extend it further into the future if you need more time to update services with the new secret; or move it into the past to immediately invalidate the previous token in case of compromise. Rotating a service token that was reported as leaked discards the previous secret entirely, so no grace period can be set.","type":"string","format":"date-time","examples":["2014-01-01T05:20:00.12345Z"]},"access_tags":{"description":"Tags associated with the service token, as key-value pairs. On update, replaces all existing tags.","type":["object","null"],"additionalProperties":{"maxLength":256,"type":"string"},"maxProperties":5,"examples":[{"environment":"production"}]}}},"name":"Create a service token","id":"cloudflare.access-service-tokens-create-a-service-token","example":{"path":{"account_id":"023e105f4ecef8ad9ca31a8372d0c353"},"body":{"name":"CI/CD token"}},"maxRequests":1,"summary":false}}