> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation.

# Create a token

`POST /api/web/v1/users/{userid}/tokens/{type}`

Create a token of the given type for the given user. Caller requires the TOKENS:ADD permission.

## Parameters

| Name | In | Required | Type | Description |
| --- | --- | --- | --- | --- |
| userid | path | Yes | string | The UUID of the user for which a token is to be created. |
| type | path | Yes | string | The type of the token to be created. Only soft tokens can be created so this value must be one of ENTRUST_SOFT_TOKEN or GOOGLE_AUTHENTICATOR. Enum: ENTRUST_PHYSICAL_TOKEN, ENTRUST_SOFT_TOKEN, GOOGLE_AUTHENTICATOR, OATH_PHYSICAL_TOKEN, ENTRUST_LEGACY_TOKEN |

## Request Body

### application/json

Schema

```json
{
  "type": "object",
  "properties": {
    "activateParms": {
      "type": "object",
      "properties": {
        "deliverActivationEmail": {
          "type": "boolean",
          "description": "A flag indicating if Identity as a Service should send an activation email including the activation information to the end user. If not specified, this attribute defaults to false."
        },
        "returnQRCode": {
          "type": "boolean",
          "description": "A flag indicating if the QR code for offline activation is returned.  The link encoded in the QR code is always returned for clients that want to encode their own QR code.  If not specified, this attribute defaults to false."
        },
        "secret": {
          "type": "string",
          "description": "The Base32-encoded secret of the token. If provided, IDaaS will use this value as the token seed and activate the token. This value is only supported for Google Authenticator. Value must contain at least 10 bytes and must not exceed 64 bytes."
        },
        "type": {
          "type": "array",
          "description": "The list of activation types that will be performed.  Allowed values are: CLASSIC (return activation values that must be manually entered into the mobile application), ONLINE (return a link that when clicked will launch the mobile application) and OFFLINE (return a QR code that can be scanned by the mobile application).  If no values are specified in the list, then all activation types are performed.",
          "items": {
            "type": "string",
            "description": "The list of activation types that will be performed.  Allowed values are: CLASSIC (return activation values that must be manually entered into the mobile application), ONLINE (return a link that when clicked will launch the mobile application) and OFFLINE (return a QR code that can be scanned by the mobile application).  If no values are specified in the list, then all activation types are performed.",
            "enum": [
              "CLASSIC",
              "ONLINE",
              "OFFLINE"
            ]
          }
        }
      },
      "description": "Optional parameters specifying how the token is to be activated. If not specified, all activation types are used, the QR code is returned and the activation email is sent.",
      "title": "ActivateParms"
    }
  },
  "description": "Optional arguments specifying if the new token is automatically activated. If these arguments are not specified, the token is activated using activation defaults.",
  "title": "TokenCreateParms"
}
```

## Responses

### 200

Successful

#### application/json

Schema

```json
{
  "required": [
    "appVerified",
    "deviceVerified",
    "pushDeliveryEnabled"
  ],
  "type": "object",
  "properties": {
    "algorithmType": {
      "type": "string",
      "description": "The algorithm type used by the token that was created or loaded into the system to generate OTP values.",
      "enum": [
        "AT",
        "OATH_HOTP",
        "OATH_OCRA",
        "OATH_TOTP",
        "VENDOR"
      ]
    },
    "allowedActions": {
      "type": "array",
      "description": "Actions that can be performed on this token.",
      "items": {
        "type": "string",
        "description": "Actions that can be performed on this token.",
        "enum": [
          "ACTIVATE",
          "REACTIVATE",
          "ACTIVATE_COMPLETE",
          "DELETE",
          "UNLOCK",
          "ENABLE",
          "DISABLE",
          "RESET",
          "ASSIGN",
          "UNASSIGN"
        ]
      }
    },
    "appVerified": {
      "type": "boolean",
      "description": "A flag indicating if the token was activated on a verified app."
    },
    "description": {
      "type": "string",
      "description": "Optional text describing this token."
    },
    "deviceVerified": {
      "type": "boolean",
      "description": "A flag indicating if the token is activated on a verified device."
    },
    "groups": {
      "type": "array",
      "description": "The UUIDs of groups to which this token belongs.  This value is only used for unassigned tokens. Only groups to which the current administrator has access will be returned.",
      "items": {
        "type": "string",
        "description": "The UUIDs of groups to which this token belongs.  This value is only used for unassigned tokens. Only groups to which the current administrator has access will be returned."
      }
    },
    "id": {
      "type": "string",
      "description": "The unique UUID assigned to the token when it is created."
    },
    "identityVerificationStatus": {
      "type": "string",
      "description": "The identity verification status of the token.",
      "enum": [
        "NOT_REQUIRED",
        "REQUIRED",
        "PENDING",
        "VERIFIED",
        "FAILED"
      ]
    },
    "label": {
      "type": "string",
      "description": "Optional label to identify an assigned token: a String up to 100 characters.",
      "example": "PENDING"
    },
    "lastUsedDate": {
      "type": "string",
      "description": "The date on which the token was last used for authentication.  This value will be null if the token has never been used.",
      "format": "date-time",
      "example": "2019-02-20T10:05:27Z"
    },
    "loadDate": {
      "type": "string",
      "description": "The date on which the token was created or loaded into the system.",
      "format": "date-time",
      "example": "2019-02-19T13:15:27Z"
    },
    "logo": {
      "type": "string",
      "description": "Base-64 encoded logo. If a custom logo is provided by the customer it is returned. Otherwise a system default logo is returned."
    },
    "name": {
      "type": "string",
      "description": "An optional name for the token."
    },
    "platform": {
      "type": "string",
      "description": "The mobile device platform on which an Entrust Soft Token was activated."
    },
    "pushDeliveryEnabled": {
      "type": "boolean",
      "description": "A flag indicating if push delivery is enabled for this token.",
      "example": true
    },
    "registeredForTransactions": {
      "type": "boolean",
      "description": "A flag indicating if the Entrust Soft Token has registered for transactions. Only tokens that are registered can perform token push authentication."
    },
    "serialNumber": {
      "type": "string",
      "description": "The serial number of the token either generated when the token was created or loaded into the system."
    },
    "state": {
      "type": "string",
      "description": "The state of the token.  For most tokens, only tokens in the ACTIVE state can be used for authentication. Google Authenticator tokens in the ACTIVATING state can also be used for authentication.",
      "enum": [
        "NEW",
        "ACTIVATING",
        "ACTIVE",
        "INACTIVE",
        "UNASSIGNED"
      ]
    },
    "supportsChallengeResponse": {
      "type": "boolean",
      "description": "A flag indicating if the Token supports challenge response processing.",
      "example": false
    },
    "supportsResponse": {
      "type": "boolean",
      "description": "A flag indicating if the Token supports response processing.",
      "example": true
    },
    "supportsSignature": {
      "type": "boolean",
      "description": "A flag indicating if the Token supports signature processing.",
      "example": false
    },
    "supportsUnlock": {
      "type": "boolean",
      "description": "A flag indicating if the Token supports unlock processing.",
      "example": true
    },
    "supportsUnlockTOTP": {
      "type": "boolean",
      "description": "A flag indicating if the Token supports unlock using TOTP processing.",
      "example": false
    },
    "type": {
      "type": "string",
      "description": "The type of token specified when the token was created or loaded into the system.",
      "enum": [
        "ENTRUST_PHYSICAL_TOKEN",
        "ENTRUST_SOFT_TOKEN",
        "GOOGLE_AUTHENTICATOR",
        "OATH_PHYSICAL_TOKEN",
        "ENTRUST_LEGACY_TOKEN"
      ]
    },
    "userId": {
      "type": "string",
      "description": "If the token is assigned to a user, this value specifies that user's user id."
    }
  },
  "description": "Information returned from the service about a token.",
  "title": "Token"
}
```

### 400

Bad Request

#### application/json

Schema

```json
{
  "type": "object",
  "properties": {
    "errorCode": {
      "type": "string",
      "description": "Error Codes specific to cause of failure.",
      "example": "invalid_user_response"
    },
    "errorMessage": {
      "type": "string",
      "description": "Additional Error Message describing the error.",
      "example": "Application id cannot be null"
    },
    "parameters": {
      "type": "array",
      "description": "Optional additional error information.",
      "items": {
        "type": "object",
        "description": "Optional additional error information."
      }
    }
  },
  "description": "Object containing information about errors reported by services.",
  "title": "ErrorInfo"
}
```

### 401

Access denied

#### application/json

Schema

```json
{
  "type": "object",
  "properties": {
    "errorCode": {
      "type": "string",
      "description": "Error Codes specific to cause of failure.",
      "example": "invalid_user_response"
    },
    "errorMessage": {
      "type": "string",
      "description": "Additional Error Message describing the error.",
      "example": "Application id cannot be null"
    },
    "parameters": {
      "type": "array",
      "description": "Optional additional error information.",
      "items": {
        "type": "object",
        "description": "Optional additional error information."
      }
    }
  },
  "description": "Object containing information about errors reported by services.",
  "title": "ErrorInfo"
}
```

### 403

Forbidden

#### application/json

Schema

```json
{
  "type": "object",
  "properties": {
    "errorCode": {
      "type": "string",
      "description": "Error Codes specific to cause of failure.",
      "example": "invalid_user_response"
    },
    "errorMessage": {
      "type": "string",
      "description": "Additional Error Message describing the error.",
      "example": "Application id cannot be null"
    },
    "parameters": {
      "type": "array",
      "description": "Optional additional error information.",
      "items": {
        "type": "object",
        "description": "Optional additional error information."
      }
    }
  },
  "description": "Object containing information about errors reported by services.",
  "title": "ErrorInfo"
}
```

### 404

Not Found

#### application/json

Schema

```json
{
  "type": "object",
  "properties": {
    "errorCode": {
      "type": "string",
      "description": "Error Codes specific to cause of failure.",
      "example": "invalid_user_response"
    },
    "errorMessage": {
      "type": "string",
      "description": "Additional Error Message describing the error.",
      "example": "Application id cannot be null"
    },
    "parameters": {
      "type": "array",
      "description": "Optional additional error information.",
      "items": {
        "type": "object",
        "description": "Optional additional error information."
      }
    }
  },
  "description": "Object containing information about errors reported by services.",
  "title": "ErrorInfo"
}
```

### 409

Conflict

#### application/json

Schema

```json
{
  "type": "object",
  "properties": {
    "errorCode": {
      "type": "string",
      "description": "Error Codes specific to cause of failure.",
      "example": "invalid_user_response"
    },
    "errorMessage": {
      "type": "string",
      "description": "Additional Error Message describing the error.",
      "example": "Application id cannot be null"
    },
    "parameters": {
      "type": "array",
      "description": "Optional additional error information.",
      "items": {
        "type": "object",
        "description": "Optional additional error information."
      }
    }
  },
  "description": "Object containing information about errors reported by services.",
  "title": "ErrorInfo"
}
```

## Security

Requirements

```json
[
  {
    "AdminAPIAuthentication": [
      "TOKENS:ADD"
    ]
  }
]
```