Add restrictions to an existing token without needing the private key.

Attenuation is a Biscuit cryptographic feature that allows anyone holding a token to add restriction blocks. The resulting token can only do a subset of what the original token could do—restrictions cannot be removed.

Security Model

This endpoint requires the token:read capability.

1. Cryptographic guarantee: Attenuation can only reduce permissions, never expand them. The Biscuit format ensures restriction blocks are append-only and cannot be removed without invalidating the signature.

2. Self-service by design: Users can only attenuate tokens they already possess. If you have a token, you can create a weaker version of it—this is analogous to being able to share read-only access to something you own.

3. No privilege escalation: The attenuated token inherits all existing restrictions from the source token, plus any new ones added. A read-only token cannot be attenuated into a read-write token.

Use Cases

• Create a read-only version of your token for delegation
• Restrict a token to specific resources or actions
• Generate time-limited tokens for external services
• Scope a broad token down to a single organization or project

Timezone

All timestamps use UTC in ISO 8601 / RFC 3339 format.

Further Reading

For the cryptographic properties of token attenuation, see the Biscuit documentation.