Create Stream Token

POST /runs/{run_id}/stream-token

Mint a short-lived credential for one run (annex 15 §5, annex 04 §4).

The run is resolved first, so a token is never minted for something the caller cannot read — a token whose audience names a run the holder has no access to would still be refused at connect time, but only after telling the caller the run exists.

Role floor

Requires viewer or above. The floor is a minimum, not a grant: scope filtering still applies on top of it, and a resource in another tenant answers 404 rather than 403.

Parameters

Name	In	Type		Notes
run_id	path	string (uuid)	required	—

Responses

Status	Description	Body
200	Successful Response	StreamToken
422	Validation Error	HTTPValidationError

Only the success paths are declared

Any operation may also answer any status in the error catalogue, and every failure body is the platform envelope — including the 422 this document types as HTTPValidationError.

Example

curl -X POST https://your-deployment.example.com/runs/{run_id}/stream-token \
  -H "Authorization: Bearer $COBRE_TOKEN"

Response — StreamToken

Field	Type		Notes
token	string	required	—
expires_in	integer	required	—