Attenuate token

curl --request POST \
  --url https://devs.adaptyvbio.com/api/v1/tokens/attenuate \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "attenuation": {
    "allowed_actions": [
      "<string>"
    ],
    "allowed_org_ids": [
      "3c90c3cc-0d44-4b50-8888-8dd25736052a"
    ],
    "allowed_resources": [
      "<string>"
    ],
    "expires_at": "2023-11-07T05:31:56Z",
    "non_destructive": true,
    "read_only": true
  },
  "name": "<string>",
  "token": "<string>",
  "attenuated_parent_token_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
}
'

import requests

url = "https://devs.adaptyvbio.com/api/v1/tokens/attenuate"

payload = {
    "attenuation": {
        "allowed_actions": ["<string>"],
        "allowed_org_ids": ["3c90c3cc-0d44-4b50-8888-8dd25736052a"],
        "allowed_resources": ["<string>"],
        "expires_at": "2023-11-07T05:31:56Z",
        "non_destructive": True,
        "read_only": True
    },
    "name": "<string>",
    "token": "<string>",
    "attenuated_parent_token_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    attenuation: {
      allowed_actions: ['<string>'],
      allowed_org_ids: ['3c90c3cc-0d44-4b50-8888-8dd25736052a'],
      allowed_resources: ['<string>'],
      expires_at: '2023-11-07T05:31:56Z',
      non_destructive: true,
      read_only: true
    },
    name: '<string>',
    token: '<string>',
    attenuated_parent_token_id: '3c90c3cc-0d44-4b50-8888-8dd25736052a'
  })
};

fetch('https://devs.adaptyvbio.com/api/v1/tokens/attenuate', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://devs.adaptyvbio.com/api/v1/tokens/attenuate",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'attenuation' => [
        'allowed_actions' => [
                '<string>'
        ],
        'allowed_org_ids' => [
                '3c90c3cc-0d44-4b50-8888-8dd25736052a'
        ],
        'allowed_resources' => [
                '<string>'
        ],
        'expires_at' => '2023-11-07T05:31:56Z',
        'non_destructive' => true,
        'read_only' => true
    ],
    'name' => '<string>',
    'token' => '<string>',
    'attenuated_parent_token_id' => '3c90c3cc-0d44-4b50-8888-8dd25736052a'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://devs.adaptyvbio.com/api/v1/tokens/attenuate"

	payload := strings.NewReader("{\n  \"attenuation\": {\n    \"allowed_actions\": [\n      \"<string>\"\n    ],\n    \"allowed_org_ids\": [\n      \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n    ],\n    \"allowed_resources\": [\n      \"<string>\"\n    ],\n    \"expires_at\": \"2023-11-07T05:31:56Z\",\n    \"non_destructive\": true,\n    \"read_only\": true\n  },\n  \"name\": \"<string>\",\n  \"token\": \"<string>\",\n  \"attenuated_parent_token_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://devs.adaptyvbio.com/api/v1/tokens/attenuate")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"attenuation\": {\n    \"allowed_actions\": [\n      \"<string>\"\n    ],\n    \"allowed_org_ids\": [\n      \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n    ],\n    \"allowed_resources\": [\n      \"<string>\"\n    ],\n    \"expires_at\": \"2023-11-07T05:31:56Z\",\n    \"non_destructive\": true,\n    \"read_only\": true\n  },\n  \"name\": \"<string>\",\n  \"token\": \"<string>\",\n  \"attenuated_parent_token_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://devs.adaptyvbio.com/api/v1/tokens/attenuate")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"attenuation\": {\n    \"allowed_actions\": [\n      \"<string>\"\n    ],\n    \"allowed_org_ids\": [\n      \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n    ],\n    \"allowed_resources\": [\n      \"<string>\"\n    ],\n    \"expires_at\": \"2023-11-07T05:31:56Z\",\n    \"non_destructive\": true,\n    \"read_only\": true\n  },\n  \"name\": \"<string>\",\n  \"token\": \"<string>\",\n  \"attenuated_parent_token_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n}"

response = http.request(request)
puts response.read_body

{
  "id": "<string>",
  "token": "<string>"
}

{
  "error": "experiment not found",
  "request_id": "req_019462a4-b1c2-7def-8901-23456789abcd"
}

{
  "error": "experiment not found",
  "request_id": "req_019462a4-b1c2-7def-8901-23456789abcd"
}

{
  "error": "experiment not found",
  "request_id": "req_019462a4-b1c2-7def-8901-23456789abcd"
}

tokens

Attenuate token

Add restrictions to an existing token without needing the private key.

Attenuation is a Biscuit cryptographic feature that allows anyone holding a token to add restriction blocks. The resulting token can only do a subset of what the original token could do—restrictions cannot be removed.

Security Model

This endpoint requires the token:read capability.

Cryptographic guarantee: Attenuation can only reduce permissions, never expand them. The Biscuit format ensures restriction blocks are append-only and cannot be removed without invalidating the signature.
Self-service by design: Users can only attenuate tokens they already possess. If you have a token, you can create a weaker version of it—this is analogous to being able to share read-only access to something you own.
No privilege escalation: The attenuated token inherits all existing restrictions from the source token, plus any new ones added. A read-only token cannot be attenuated into a read-write token.

Use Cases

Create a read-only version of your token for delegation
Restrict a token to specific resources or actions
Generate time-limited tokens for external services
Scope a broad token down to a single organization or project

Timezone

All timestamps use UTC in ISO 8601 / RFC 3339 format.

curl --request POST \
  --url https://devs.adaptyvbio.com/api/v1/tokens/attenuate \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "attenuation": {
    "allowed_actions": [
      "<string>"
    ],
    "allowed_org_ids": [
      "3c90c3cc-0d44-4b50-8888-8dd25736052a"
    ],
    "allowed_resources": [
      "<string>"
    ],
    "expires_at": "2023-11-07T05:31:56Z",
    "non_destructive": true,
    "read_only": true
  },
  "name": "<string>",
  "token": "<string>",
  "attenuated_parent_token_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
}
'

import requests

url = "https://devs.adaptyvbio.com/api/v1/tokens/attenuate"

payload = {
    "attenuation": {
        "allowed_actions": ["<string>"],
        "allowed_org_ids": ["3c90c3cc-0d44-4b50-8888-8dd25736052a"],
        "allowed_resources": ["<string>"],
        "expires_at": "2023-11-07T05:31:56Z",
        "non_destructive": True,
        "read_only": True
    },
    "name": "<string>",
    "token": "<string>",
    "attenuated_parent_token_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    attenuation: {
      allowed_actions: ['<string>'],
      allowed_org_ids: ['3c90c3cc-0d44-4b50-8888-8dd25736052a'],
      allowed_resources: ['<string>'],
      expires_at: '2023-11-07T05:31:56Z',
      non_destructive: true,
      read_only: true
    },
    name: '<string>',
    token: '<string>',
    attenuated_parent_token_id: '3c90c3cc-0d44-4b50-8888-8dd25736052a'
  })
};

fetch('https://devs.adaptyvbio.com/api/v1/tokens/attenuate', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://devs.adaptyvbio.com/api/v1/tokens/attenuate",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'attenuation' => [
        'allowed_actions' => [
                '<string>'
        ],
        'allowed_org_ids' => [
                '3c90c3cc-0d44-4b50-8888-8dd25736052a'
        ],
        'allowed_resources' => [
                '<string>'
        ],
        'expires_at' => '2023-11-07T05:31:56Z',
        'non_destructive' => true,
        'read_only' => true
    ],
    'name' => '<string>',
    'token' => '<string>',
    'attenuated_parent_token_id' => '3c90c3cc-0d44-4b50-8888-8dd25736052a'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://devs.adaptyvbio.com/api/v1/tokens/attenuate"

	payload := strings.NewReader("{\n  \"attenuation\": {\n    \"allowed_actions\": [\n      \"<string>\"\n    ],\n    \"allowed_org_ids\": [\n      \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n    ],\n    \"allowed_resources\": [\n      \"<string>\"\n    ],\n    \"expires_at\": \"2023-11-07T05:31:56Z\",\n    \"non_destructive\": true,\n    \"read_only\": true\n  },\n  \"name\": \"<string>\",\n  \"token\": \"<string>\",\n  \"attenuated_parent_token_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://devs.adaptyvbio.com/api/v1/tokens/attenuate")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"attenuation\": {\n    \"allowed_actions\": [\n      \"<string>\"\n    ],\n    \"allowed_org_ids\": [\n      \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n    ],\n    \"allowed_resources\": [\n      \"<string>\"\n    ],\n    \"expires_at\": \"2023-11-07T05:31:56Z\",\n    \"non_destructive\": true,\n    \"read_only\": true\n  },\n  \"name\": \"<string>\",\n  \"token\": \"<string>\",\n  \"attenuated_parent_token_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://devs.adaptyvbio.com/api/v1/tokens/attenuate")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"attenuation\": {\n    \"allowed_actions\": [\n      \"<string>\"\n    ],\n    \"allowed_org_ids\": [\n      \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n    ],\n    \"allowed_resources\": [\n      \"<string>\"\n    ],\n    \"expires_at\": \"2023-11-07T05:31:56Z\",\n    \"non_destructive\": true,\n    \"read_only\": true\n  },\n  \"name\": \"<string>\",\n  \"token\": \"<string>\",\n  \"attenuated_parent_token_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n}"

response = http.request(request)
puts response.read_body

{
  "id": "<string>",
  "token": "<string>"
}

{
  "error": "experiment not found",
  "request_id": "req_019462a4-b1c2-7def-8901-23456789abcd"
}

{
  "error": "experiment not found",
  "request_id": "req_019462a4-b1c2-7def-8901-23456789abcd"
}

{
  "error": "experiment not found",
  "request_id": "req_019462a4-b1c2-7def-8901-23456789abcd"
}

Authorizations

Authorization

string

header

required

Biscuit-based bearer token. Obtain tokens from the Adaptyv Portal or via the /tokens endpoint. Tokens encode organization membership and role-based capabilities; the API verifies the token's cryptographic signature and authorization claims before processing requests. Use /tokens/attenuate to create restricted tokens for delegation.

Body

application/json

Request to attenuate (restrict) an existing token.

Attenuation is a Biscuit cryptographic feature that adds restriction blocks without needing the private signing key. Any authenticated user can attenuate their tokens to create limited-scope versions for delegation.

attenuation

object

required

Restrictions to apply to the token.

Show child attributes

name

string

required

Human-readable label for this attenuated token.

Names are not unique — they are purely for display purposes.

token

string

required

Existing token string (format: abs0_{slug}{biscuit_base64}) to attenuate.

attenuated_parent_token_id

string<uuid> | null

If attenuating an already-attenuated token (chained attenuation), provide the id of the parent attenuated token record. Omit when attenuating a root token directly.

Response

Token attenuated and persisted

Response after attenuating a token.

string

required

Database ID of the attenuated token record (for revocation/management).

token

string

required

The attenuated token string. Format: abs0_{slug}{biscuit_base64}.

List tokens Revoke the calling token and its entire lineage

⌘I

Getting Started

API Endpoints

Attenuate token

Security Model

Use Cases

Timezone

Further Reading

Authorizations

Body

Response