> ## Documentation Index > Fetch the complete documentation index at: https://docs.spitshake.io/llms.txt > Use this file to discover all available pages before exploring further. # Mint tenant API tokens > Issue a replacement tenant token for a managed account. This endpoint mints a tenant API token for the account's provisioned partner admin. If that user is missing or archived, the oldest active admin is used. The insert and audit event are atomic. ```bash theme={null} curl -X POST https://spitshake.io/api/partner/v1/accounts/412/tokens \ -H "Authorization: Bearer $SPITSHAKE_PARTNER_KEY" \ -H "Idempotency-Key: token-rotation-2026-07-22" \ -H "Content-Type: application/json" \ -d '{}' ``` ```json 201 theme={null} { "account": { "id": 412, "external_id": "firm-8675309" }, "admin": { "id": 991, "email": "admin@acme.example" }, "api_token": "2ff154a0405e..." } ``` The raw token is shown only in the first response and exact idempotent replays. Store it securely. The token authenticates the ordinary tenant API, not the Partner API. | Status | Meaning | | ------ | -------------------------------------------------------------------------------- | | `401` | Missing or invalid partner key. | | `403` | Partner access is suspended. | | `404` | Account is not owned by this partner. | | `409` | Another request with this endpoint/key is still in flight. | | `422` | No active admin exists, or the idempotency key was reused with a different body. | ## OpenAPI ````yaml post /api/partner/v1/accounts/{id}/tokens openapi: 3.0.3 info: title: SpitShake API version: 1.0.0 description: > SpitShake is a document signing and e-signature platform. This API allows you to manage templates, send documents for signing, track submissions, and integrate document signing into your applications. ## Authentication SpitShake supports the tenant authentication methods below plus an isolated partner credential: ### API Token (Recommended) Pass your API token in the `X-Auth-Token` header or as `Authorization: Bearer `. Generate tokens at **Settings > API** with granular scopes. ``` curl -H "X-Auth-Token: YOUR_TOKEN" https://your-instance.com/api/templates ``` ### OAuth 2.1 (Authorization Code + PKCE) For connector directories and third-party agents. Discover endpoints at `GET /.well-known/oauth-authorization-server`. PKCE is mandatory. ### Session Cookie Automatically set when logged into the web application. Used by the frontend. ### JWT Bearer Token (Embed API only) For embedded forms and builders. Generate via `POST /api/embed/token`. ``` curl -H "Authorization: Bearer JWT_TOKEN" https://your-instance.com/api/embed/submission/123 ``` ### Partner Bearer Key (`/api/partner/v1` only) Operator-issued `spk_` keys authenticate the reseller control plane. Partner keys and tenant credentials are mutually non-acceptable. ## Idempotency Create and send operations accept an `Idempotency-Key` header. A repeated request with the same key and body replays the original response without creating a duplicate. Keys expire after 24 hours. ## Versioning Tenant API responses include an `X-API-Version: v1` header. The tenant API is available at both `/api/*` and `/api/v1/*` (explicit pin). Partner responses include `X-API-Version: partner-v1`, and that control plane is separately pinned at `/api/partner/v1/*`. ## Pagination List endpoints use cursor-based pagination: | Parameter | Type | Description | |-----------|------|-------------| | `limit` | integer | Items per page (1-100, default 10) | | `after` | integer | Return items after this ID | | `before` | integer | Return items before this ID | Response includes a `pagination` object: ```json { "data": [...], "pagination": { "count": 10, "next": 456, "prev": 123 } } ``` Use `pagination.next` as the `after` parameter to get the next page. ## Rate Limits API requests are limited to 120 requests per minute per API token. Partner API requests are limited to 100 requests per minute per partner key. ## Errors All errors return a JSON object with an `error` field: ```json { "error": "Not found" } ``` | Status | Meaning | |--------|---------| | 400 | Bad request - invalid parameters | | 401 | Unauthorized - invalid or missing authentication | | 403 | Forbidden - insufficient permissions or plan limits exceeded | | 404 | Not found | | 422 | Unprocessable entity - validation errors | | 500 | Internal server error (includes `detail` field with exception message for debugging) | ## Plan Limits Some endpoints require specific subscription plans. If your plan doesn't support an endpoint, you'll receive a 403 response with an `upgrade_url` field. contact: name: SpitShake Support url: https://spitshake.io license: name: Proprietary servers: - url: / description: Current instance security: - ApiToken: [] - SessionCookie: [] tags: - name: Templates description: Manage document templates with fields, submitters, and documents - name: Submissions description: Create and manage document signing submissions - name: Submitters description: Manage individual submitters (signers) within submissions - name: Users description: Manage account users and team members - name: Access Tokens description: Manage API tokens for programmatic access (requires Pro plan) - name: Webhooks description: Configure webhook endpoints for event notifications (requires Pro plan) - name: Settings description: Account settings, SMTP, storage, certificates, and email configuration - name: Audit Events description: View audit log of account activities (requires Pro plan) - name: Subscriptions description: View current plan, usage, and manage billing - name: Plans description: List available subscription plans (public) - name: Payments description: Process payments within signing flows via Stripe - name: Verification description: SMS OTP phone verification for signing sessions - name: KBA description: Knowledge-Based Authentication for identity verification - name: AI description: AI-powered document analysis and field detection - name: Embed description: Embed signing forms and template builders in your application - name: Custom Domains description: >- Manage custom signing domains with automatic SSL provisioning via Cloudflare - name: Teams description: Team management and template access control - name: Health description: System health check endpoints (public) - name: MFA description: Multi-Factor Authentication setup, management, and verification - name: BAA description: Business Associate Agreement acceptance and management (HIPAA) - name: Security Events description: Security event monitoring and breach detection dashboard (admin only) - name: Thumbnails description: Template document thumbnail generation and retrieval - name: Partner API description: >- Versioned reseller control plane for provisioning and metering isolated tenant accounts paths: /api/partner/v1/accounts/{id}/tokens: post: tags: - Partner API summary: Mint a tenant API token description: > Mints for the configured partner admin, falling back to the oldest active admin. Exact idempotent replays include the original token for timeout recovery. operationId: createPartnerAccountToken parameters: - name: id in: path required: true schema: type: integer - name: Idempotency-Key in: header required: false schema: type: string maxLength: 255 requestBody: required: false content: application/json: schema: type: object additionalProperties: false example: {} responses: '201': description: Tenant API token minted and audited headers: Idempotency-Replayed: schema: type: string enum: - 'true' content: application/json: schema: $ref: '#/components/schemas/PartnerTokenResponse' example: account: id: 412 external_id: firm-8675309 admin: id: 991 email: admin@acme.example api_token: 2ff154a0405e... '401': description: Missing or unknown partner key content: application/json: schema: $ref: '#/components/schemas/Error' example: error: Unauthorized '403': description: Partner is suspended content: application/json: schema: $ref: '#/components/schemas/Error' example: error: Partner access is suspended '404': description: Account is not owned by this partner content: application/json: schema: $ref: '#/components/schemas/Error' example: error: Not found '409': description: Concurrent idempotency claim content: application/json: schema: $ref: '#/components/schemas/Error' example: error: A request with this Idempotency-Key is still being processed '422': description: No active admin or changed idempotent request content: application/json: schema: $ref: '#/components/schemas/Error' examples: no_admin: value: error: No active admin is available for token minting idempotency: value: error: Idempotency-Key was already used with a different request security: - PartnerBearer: [] components: schemas: PartnerTokenResponse: type: object required: - account - admin - api_token properties: account: type: object required: - id - external_id properties: id: type: integer external_id: type: string nullable: true admin: type: object required: - id - email properties: id: type: integer email: type: string format: email api_token: type: string description: Tenant API token returned only once and on exact idempotent replay. Error: type: object properties: error: oneOf: - type: string - type: array items: type: string securitySchemes: ApiToken: type: apiKey in: header name: X-Auth-Token description: API token generated at Settings > API SessionCookie: type: apiKey in: cookie name: _docutrust_session description: Session cookie (automatic when logged in) PartnerBearer: type: http scheme: bearer bearerFormat: spk_ description: Operator-issued partner key. Accepted only under /api/partner/v1. ````