POST /v1/agent/bootstrap_tokens - SEC API for AI

curl -X POST \
  -H "Authorization: Bearer $SECAPI_BEARER_TOKEN" \
  -H "secapi-version: 2026-03-19" \
  -H "content-type: application/json" \
  -d '{"label":"research-agent","scopes":["read:sec"],"ttlSeconds":900}' \
  "https://api.secapi.ai/v1/agent/bootstrap_tokens"

{
  "object": "agent_bootstrap_token",
  "id": "agtok_example",
  "orgId": "org_example",
  "actorPrincipalId": "user_example",
  "label": "research-agent",
  "tokenPrefix": "agtok_example",
  "scopes": ["read:sec"],
  "livemode": false,
  "expiresAt": "2026-03-19T12:15:00.000Z",
  "usedAt": null,
  "usedByPrincipalId": null,
  "createdAt": "2026-03-19T12:00:00.000Z",
  "updatedAt": "2026-03-19T12:00:00.000Z",
  "secret": "agtok_example_secret_returned_once",
  "requestId": "req_2ZK8Q1W9F4M6P7R3"
}

Issue a short-lived, single-use sponsor token for agent bootstrap under the current organization

Audience: application and coding agent.

Canonical metadata

requestId
id
tokenPrefix
scopes
expiresAt
usedAt

Example request

curl -X POST \
  -H "Authorization: Bearer $SECAPI_BEARER_TOKEN" \
  -H "secapi-version: 2026-03-19" \
  -H "content-type: application/json" \
  -d '{"label":"research-agent","scopes":["read:sec"],"ttlSeconds":900}' \
  "https://api.secapi.ai/v1/agent/bootstrap_tokens"

Example response

{
  "object": "agent_bootstrap_token",
  "id": "agtok_example",
  "orgId": "org_example",
  "actorPrincipalId": "user_example",
  "label": "research-agent",
  "tokenPrefix": "agtok_example",
  "scopes": ["read:sec"],
  "livemode": false,
  "expiresAt": "2026-03-19T12:15:00.000Z",
  "usedAt": null,
  "usedByPrincipalId": null,
  "createdAt": "2026-03-19T12:00:00.000Z",
  "updatedAt": "2026-03-19T12:00:00.000Z",
  "secret": "agtok_example_secret_returned_once",
  "requestId": "req_2ZK8Q1W9F4M6P7R3"
}

Authentication

This is a human organization action. Send a bearer token for a signed-in organization member. API keys are rejected. The sponsor-token secret is returned once; do not log it.

Give this prompt to your agent

Failure posture

treat non-2xx responses as contract-aware failures, not free-form errors
preserve requestId and traceparent in logs and downstream reports
if provenance or freshness metadata is present, return it unchanged so trust is not lost in the handoff