Access Tokens
Access tokens allow you to authenticate with the vHaaS API.
vHaaS knows two kinds:
- Personal access tokens belong to one user and act with that user's own permissions.
- Scoped access tokens belong to a group or an organization and are backed by a technical user.
Use cases
Use a personal access token for anything acting on your behalf with your own permissions: scripts, the CLI, or an AI assistant.
Use a scoped access token for automation: see Basic CI integration.
Scope
A scoped access token is limited to a specific organizational scope that is defined when the token is created. The scope determines which resources the token can reach and who can manage it.
Organization-level tokens reach the assemblies that are public in the organization; with the admin role assigned, they reach every assembly of the organization, including the group-bound ones. Only organization admins can create and manage them.
Group-level tokens reach the assemblies of their group, plus the assemblies that are public in the organization. Only group admins can create and manage them.
Which scope you need follows from the assembly you want to book. See Organization and Visibility Structure.
For creating, revoking and configuring tokens, see Manage Scoped Access Tokens.
Technical User
In vHaaS, access tokens at group or organization level are backed by a system-created user — the technical user — which holds the corresponding permissions on behalf of the token.
When actions are performed using an access token, the technical user appears as the actor in the session list and the assembly calendar. If you use a personal access token instead, your own account is shown.
Technical users are created automatically when an access token is issued at group or organization level. They are not managed like regular users: group membership and role are fixed by the token when it is created, while version control access and environment variables are configured on the token itself.