> ## Documentation Index
> Fetch the complete documentation index at: https://felan.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Exchange a personal access token for a scoped host token

> Creates or reuses a host for the (PAT, installId) pair. A new PAT creates a new host. Rechecks team membership, PAT and host revocation, and schema support on every exchange. All responses use Cache-Control: no-store. The name is limited to 128 UTF-8 bytes.



## OpenAPI

````yaml /openapi/v1.json post /hosts/token
openapi: 3.1.0
info:
  title: Felan API
  description: >-
    Team-scoped access to Felan sessions, integrations, environments,
    environment variables, automations, skills, custom subagents, and inbound
    events.
  version: 1.0.0
  contact:
    name: Felan Support
    url: https://felan.ai
servers:
  - url: https://app.felan.ai/api/v1
    description: Production
security:
  - bearerAuth: []
tags:
  - name: Hosts
  - name: Teams
  - name: Integrations
  - name: Environments
  - name: Environment Variables
  - name: Automations
  - name: Skills
  - name: Subagents
  - name: Sessions
  - name: Events
  - name: OpenAPI
paths:
  /hosts/token:
    post:
      tags:
        - Hosts
      summary: Exchange a personal access token for a scoped host token
      description: >-
        Creates or reuses a host for the (PAT, installId) pair. A new PAT
        creates a new host. Rechecks team membership, PAT and host revocation,
        and schema support on every exchange. All responses use Cache-Control:
        no-store. The name is limited to 128 UTF-8 bytes.
      operationId: exchangeHostToken
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/HostTokenRequest'
      responses:
        '200':
          description: >-
            Scoped ES256 host token, valid for at most 15 minutes. Never cache
            this response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HostTokenResponse'
        '400':
          description: 'invalid_request: malformed JSON or invalid HostTokenRequest.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HostTokenError'
        '401':
          description: >-
            invalid_pat: missing, unknown, revoked (for a current member), or
            non-personal credential.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HostTokenError'
        '403':
          description: >-
            not_a_member: the personal token owner left the team (including when
            the token was revoked on departure); host_revoked: this pairing was
            revoked.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HostTokenError'
        '426':
          description: >-
            unsupported_schema: protocol or row schema version is not supported;
            supported lists accepted versions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HostTokenError'
        '429':
          description: 'rate_limited: retry with backoff according to Retry-After.'
          headers:
            Retry-After:
              description: Seconds until the rate limit resets.
              schema:
                type: integer
                minimum: 1
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HostTokenError'
        '500':
          description: 'internal_error: retry with backoff.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HostTokenError'
      security:
        - personalAccessToken: []
components:
  schemas:
    HostTokenRequest:
      type: object
      required:
        - installId
        - name
        - daemonVersion
        - protocol
        - rowSchemaVersion
      properties:
        installId:
          type: string
          pattern: >-
            ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$
        name:
          type: string
          minLength: 1
          maxLength: 128
          x-maxBytes: 128
        daemonVersion:
          type: string
          minLength: 1
          maxLength: 128
          x-maxBytes: 128
        protocol:
          type: number
          const: 1
        rowSchemaVersion:
          type: integer
          minimum: 0
          maximum: 9007199254740991
    HostTokenResponse:
      type: object
      required:
        - token
        - expiresAt
        - refreshAt
        - host
        - supabase
      properties:
        token:
          type: string
          minLength: 1
        expiresAt:
          type: integer
          minimum: 0
          maximum: 9007199254740991
        refreshAt:
          type: integer
          minimum: 0
          maximum: 9007199254740991
        host:
          type: object
          required:
            - id
            - teamId
            - userId
          properties:
            id:
              type: string
              pattern: >-
                ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$
            teamId:
              type: string
              pattern: >-
                ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$
            userId:
              type: string
              pattern: >-
                ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$
        supabase:
          type: object
          required:
            - url
            - publishableKey
          properties:
            url:
              type: string
              minLength: 1
              maxLength: 2048
              x-maxBytes: 2048
            publishableKey:
              type: string
              minLength: 1
              maxLength: 256
              x-maxBytes: 256
    HostTokenError:
      type: object
      required:
        - code
        - message
      properties:
        code:
          type: string
          minLength: 1
          maxLength: 128
          x-maxBytes: 128
        message:
          type: string
          minLength: 0
          maxLength: 4096
          x-maxBytes: 4096
          pattern: "^[^\0-\x1F\x7F-\x9F]*$"
        supported:
          type: object
          required:
            - protocol
            - rowSchemaVersion
          properties:
            protocol:
              type: array
              items:
                type: integer
                minimum: 0
                maximum: 9007199254740991
            rowSchemaVersion:
              type: array
              items:
                type: integer
                minimum: 0
                maximum: 9007199254740991
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: Team API key. Current keys retain the bzy_team_ compatibility prefix.
    personalAccessToken:
      type: http
      scheme: bearer
      description: >-
        Personal access token (fln_pat_…). Only accepted by the host token
        exchange.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.