Skip to navigation
AgentFS APIAgent Filesystem

Agents Access Token Mint

Preview
View as Markdown

Mints a short-lived, non-refreshable access token for one agent with the requested OAuth scopes. Each requested scope must be granted to the user access token making the request. The token acts as the agent’s owning user on supported Dropbox file operations without Dropbox-API-Select-User. The app and user grant must allow each requested scope. The agent token cannot call Agent Filesystem management routes or change its own access. Revoke the token with auth/token/revoke, using the agent access token to authenticate that call.

Required scope: private:agent_filesystem.agents.manage

Endpoint format: RPC

Authentication: User

This endpoint does not support apps with the app folder permission.

Authentication

AuthorizationBearer

OAuth 2.0 token issued to a specific user. Use Authorization: Bearer <token>.

Public clients should use the authorization code flow with PKCE (S256).

For background or offline access, send token_access_type=offline during authorization and use the returned refresh token to obtain new access tokens.

You can generate a short-lived access token from the App Console; see Testing with a generated token.

Headers

Dropbox-API-Select-UserstringOptional

Acts on behalf of a team member for supported user-auth operations. Pass a team member ID such as dbmid:.... When used with a team token, that token must also include the team_data.member scope.

Dropbox-API-Path-RootstringOptional

Scopes path-based operations to a namespace (root). The value is a JSON serialization of the common.PathRoot union: {".tag": "home"}, {".tag": "root", "root": "<namespace_id>"}, or {".tag": "namespace_id", "namespace_id": "<namespace_id>"}. On failure the request returns 422 with a common.PathRootError.

Request

This endpoint expects an object.
agentobjectRequired
Agent that will use the token. The agent must belong to the authenticated user.
Variant:
agent_filesystem.AgentSelector.agent_idobjectRequired
Selects the agent by its Agent Filesystem ID.
scopestring or nullOptional1-2048 characters

Space-separated OAuth scopes for the token. Supported scopes are files.metadata.read, files.metadata.write, files.content.read, files.content.write, and account_info.read. Include account_info.read for clients that discover the account’s root namespace. Omit to request all four file scopes. Every requested scope must also be granted to the app and the user access token making the request.

session_external_idstring or nullOptional1-255 characters
Optional run or job ID from your system. This value supports attribution and audit correlation. It does not grant access.

Response headers

X-Dropbox-Request-IdstringOptional
A unique identifier for the request, useful for debugging and support.

Response

Successful response
access_tokenstring1-8192 characters

Short-lived OAuth access token that acts as the agent’s owning user with the requested scopes. Keep it in the agent runtime, not a browser.

expires_inuint1-4294967295
Number of seconds until the access token expires.

Errors

401
Unauthorized Error
403
Forbidden Error
409
Conflict Error
429
Too Many Requests Error
500
Internal Server Error