pve_token_create
Create an API token for a Proxmox VE user. Dry-run preview shows privilege separation risk; confirm execution returns the token secret once.
Instructions
MUTATION: create an API token for a user.
Dry-run by default — the PLAN shows risk (privsep=False is HIGH: token inherits ALL owner perms). confirm=True executes and returns a dict whose result carries the token secret (value) ONCE — it is never written to the audit ledger and cannot be retrieved again. Synchronous. Use pve_tokens_list to see a user's existing tokens, or pve_token_revoke to remove one.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| expire | No | Optional token expiry as a Unix timestamp; None means no expiry. | |
| userid | Yes | Owning user, format 'user@realm'. | |
| comment | No | Optional free-text comment describing the token's purpose. | |
| confirm | No | False (default) returns a dry-run PLAN preview; True executes the mutation. | |
| privsep | No | Privilege separation: True (default) restricts the token to its own ACL grants; False lets it inherit ALL owner permissions. | |
| tokenid | Yes | Name for the new API token, unique per user. | |
| proximo_target | No | Which configured Proxmox target to run this call against — a target name from your multi-target config (a specific PVE/PBS/PMG/PDM box). Omit to use the single/default target from the environment; the selection applies only to this call. |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |