curl --request POST \
--url https://api.openworklabs.com/v1/workbot/run-token \
--header 'Content-Type: application/json' \
--header 'x-api-key: <api-key>' \
--data '
{
"ttlMs": 1830000,
"readOnly": true,
"sessionId": "<string>",
"messageId": "<string>",
"model": "<string>",
"modelAccessRequired": true
}
'import requests
url = "https://api.openworklabs.com/v1/workbot/run-token"
payload = {
"ttlMs": 1830000,
"readOnly": True,
"sessionId": "<string>",
"messageId": "<string>",
"model": "<string>",
"modelAccessRequired": True
}
headers = {
"x-api-key": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'x-api-key': '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({
ttlMs: 1830000,
readOnly: true,
sessionId: '<string>',
messageId: '<string>',
model: '<string>',
modelAccessRequired: true
})
};
fetch('https://api.openworklabs.com/v1/workbot/run-token', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.openworklabs.com/v1/workbot/run-token",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'ttlMs' => 1830000,
'readOnly' => true,
'sessionId' => '<string>',
'messageId' => '<string>',
'model' => '<string>',
'modelAccessRequired' => true
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"x-api-key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.openworklabs.com/v1/workbot/run-token"
payload := strings.NewReader("{\n \"ttlMs\": 1830000,\n \"readOnly\": true,\n \"sessionId\": \"<string>\",\n \"messageId\": \"<string>\",\n \"model\": \"<string>\",\n \"modelAccessRequired\": true\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("x-api-key", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.openworklabs.com/v1/workbot/run-token")
.header("x-api-key", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"ttlMs\": 1830000,\n \"readOnly\": true,\n \"sessionId\": \"<string>\",\n \"messageId\": \"<string>\",\n \"model\": \"<string>\",\n \"modelAccessRequired\": true\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.openworklabs.com/v1/workbot/run-token")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["x-api-key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"ttlMs\": 1830000,\n \"readOnly\": true,\n \"sessionId\": \"<string>\",\n \"messageId\": \"<string>\",\n \"model\": \"<string>\",\n \"modelAccessRequired\": true\n}"
response = http.request(request)
puts response.read_body{
"token": "<string>",
"expiresAt": "2023-11-07T05:31:56Z",
"resumeGrant": "<string>",
"modelAccess": {
"baseUrl": "<string>",
"apiKey": "<string>",
"protocol": "anthropic",
"model": "<string>"
},
"indexCapability": "<string>"
}{
"error": "unauthorized"
}{
"error": "<string>",
"message": "<string>"
}{
"error": "rate_limited",
"retryAfter": 123
}A short-lived token for one Workbot turn
For the Workbot app only. Mints the member-scoped MCP token a Workbot turn uses to reach the person’s connected apps on the headless runner, for at most an hour. With sessionId and messageId, and where turns keep going on their own for the workspace, also returns a resume grant for that turn. With sessionId and where the session index is on for the workspace, also returns an index capability for that session. With scoped model access, also returns the member’s Gateway or managed Models route and bearer credential for the exact selected model, rechecking access for every turn. This response is server-to-server only and must not be forwarded to a browser or logged. Refused when Workbot is off for the workspace.
curl --request POST \
--url https://api.openworklabs.com/v1/workbot/run-token \
--header 'Content-Type: application/json' \
--header 'x-api-key: <api-key>' \
--data '
{
"ttlMs": 1830000,
"readOnly": true,
"sessionId": "<string>",
"messageId": "<string>",
"model": "<string>",
"modelAccessRequired": true
}
'import requests
url = "https://api.openworklabs.com/v1/workbot/run-token"
payload = {
"ttlMs": 1830000,
"readOnly": True,
"sessionId": "<string>",
"messageId": "<string>",
"model": "<string>",
"modelAccessRequired": True
}
headers = {
"x-api-key": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'x-api-key': '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({
ttlMs: 1830000,
readOnly: true,
sessionId: '<string>',
messageId: '<string>',
model: '<string>',
modelAccessRequired: true
})
};
fetch('https://api.openworklabs.com/v1/workbot/run-token', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.openworklabs.com/v1/workbot/run-token",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'ttlMs' => 1830000,
'readOnly' => true,
'sessionId' => '<string>',
'messageId' => '<string>',
'model' => '<string>',
'modelAccessRequired' => true
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"x-api-key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.openworklabs.com/v1/workbot/run-token"
payload := strings.NewReader("{\n \"ttlMs\": 1830000,\n \"readOnly\": true,\n \"sessionId\": \"<string>\",\n \"messageId\": \"<string>\",\n \"model\": \"<string>\",\n \"modelAccessRequired\": true\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("x-api-key", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.openworklabs.com/v1/workbot/run-token")
.header("x-api-key", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"ttlMs\": 1830000,\n \"readOnly\": true,\n \"sessionId\": \"<string>\",\n \"messageId\": \"<string>\",\n \"model\": \"<string>\",\n \"modelAccessRequired\": true\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.openworklabs.com/v1/workbot/run-token")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["x-api-key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"ttlMs\": 1830000,\n \"readOnly\": true,\n \"sessionId\": \"<string>\",\n \"messageId\": \"<string>\",\n \"model\": \"<string>\",\n \"modelAccessRequired\": true\n}"
response = http.request(request)
puts response.read_body{
"token": "<string>",
"expiresAt": "2023-11-07T05:31:56Z",
"resumeGrant": "<string>",
"modelAccess": {
"baseUrl": "<string>",
"apiKey": "<string>",
"protocol": "anthropic",
"model": "<string>"
},
"indexCapability": "<string>"
}{
"error": "unauthorized"
}{
"error": "<string>",
"message": "<string>"
}{
"error": "rate_limited",
"retryAfter": 123
}Authorizations
Organization API key passed as the x-api-key header. The raw key is the header value; do not prefix it with Bearer.
Body
Response
The token.
^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z))$Show child attributes
Show child attributes
Was this page helpful?