> ## Documentation Index > Fetch the complete documentation index at: https://docs.fly.io/llms.txt > Use this file to discover all available pages before exploring further. # Authorize token for resource access > Verify a token header and validate it against a requested access scope. ## OpenAPI ````yaml /machines-api/openapi.json post /v1/tokens/authorize openapi: 3.0.1 info: title: Machines API description: >- This site hosts documentation generated from the Fly.io Machines API OpenAPI specification. Visit our complete [Machines API docs](https://fly.io/docs/machines/api/) for how to get started, more information about each endpoint, parameter descriptions, and examples. contact: {} license: name: Apache 2.0 url: http://www.apache.org/licenses/LICENSE-2.0.html version: '1.0' servers: - url: https://api.machines.dev security: [] tags: - name: Apps description: >- This site hosts documentation generated from the Fly.io Machines API OpenAPI specification. Visit our complete [Machines API docs](https://fly.io/docs/machines/api/apps-resource/) for details about using the Apps resource. - name: Machines description: >- This site hosts documentation generated from the Fly.io Machines API OpenAPI specification. Visit our complete [Machines API docs](https://fly.io/docs/machines/api/machines-resource/) for details about using the Machines resource. - name: TLS Certificates description: > This site hosts documentation generated from the Fly.io Machines API OpenAPI specification. Visit our complete [Machines API docs](https://fly.io/docs/machines/api/certificates-resource/) for details about using the TLS Certificates resource. - name: Volumes description: >- This site hosts documentation generated from the Fly.io Machines API OpenAPI specification. Visit our complete [Machines API docs](https://fly.io/docs/machines/api/volumes-resource/) for details about using the Volumes resource. - name: Postgres Clusters description: >- Create and manage Postgres clusters, including databases, users, extensions, backups, and app attachments. externalDocs: url: https://fly.io/docs/machines/working-with-machines/ paths: /v1/tokens/authorize: post: tags: - Tokens summary: Authorize token for resource access description: Verify a token header and validate it against a requested access scope. operationId: Tokens_authorize requestBody: description: Authorize token request content: application/json: schema: $ref: '#/components/schemas/authorizeTokenRequest' required: true responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/authorizeResponse' '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '500': description: Internal Server Error content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' components: schemas: authorizeTokenRequest: type: object properties: access: $ref: '#/components/schemas/main.TokenAccess' header: type: string authorizeResponse: type: object properties: access: $ref: '#/components/schemas/flyio.Access' verified_token: $ref: '#/components/schemas/root.VerifiedToken' ErrorResponse: type: object properties: details: type: object description: Deprecated error: type: string status: $ref: '#/components/schemas/main.statusCode' main.TokenAccess: type: object properties: action: type: object description: >- Action is the action being taken on the specified resource. This is the combination of individual action characters (e.g "rw") - r: read - w: write - c: create - d: delete - C: control allOf: - $ref: '#/components/schemas/resset.Action' app_feature: type: string description: >- AppFeature is a named set of functionality associated with the app. If this is specified, the AppName field must be set. - images: images in the fly.io registry app_name: type: string description: AppName is the name of the app being accessed. command: type: array description: >- Command is the command being executed on a machine. If this is specified, the Machine must be set. items: type: string machine_feature: type: string description: |- MachineFeature is a named set of functionality associated with the machine. If this is specified, the Machine field must be set. - metadata: machine metadata service - oidc: OIDC tokens - kmstoken: Petsem tokens for KMS access machine_id: type: string description: >- MachineID is the ID of the machine being accessed (e.g. 7811701f564258). mutation: type: string description: Mutation is the GraphQL mutation being performed. org_feature: type: string description: |- OrgFeature is a named set of functionality associated with the organization. If this is specified, the OrgSlug field must be set. - wg: WireGuard peers - builder: remote builders - addon: addons - membership: organization membership - billing: billing - litefs-cloud: LiteFS Cloud - authentication: authentication settings org_slug: type: string description: OrgSlug is the slug of the organization being accessed. source_machine: type: string description: SourceMachine is the machine ID of the actor attempting access. storage_object: type: string description: >- StorageObject is the storage object being accessed. If this is specified, the OrgSlug must be set. volume_id: type: string description: |- VolumeID is the encoded ID of the volume being accessed (e.g. vol_r1p6pln1k9m9j7zr). flyio.Access: type: object properties: action: $ref: '#/components/schemas/resset.Action' app_feature: type: string appid: type: integer cluster: type: string command: type: array items: type: string feature: type: string machine: type: string machine_feature: type: string mutation: type: string orgid: type: integer sourceApp: type: string sourceMachine: type: string sourceOrganization: type: string storage_object: type: string volume: type: string root.VerifiedToken: type: object properties: caveats: $ref: '#/components/schemas/macaroon.CaveatSet' header: type: string nonce: $ref: '#/components/schemas/macaroon.Nonce' permission_token: type: array items: type: integer main.statusCode: type: string enum: - unknown - insufficient_capacity - volume_placement_capacity - name_taken x-enum-varnames: - unknown - capacityErr - volumePlacementCapacityErr - nameTakenErr resset.Action: type: integer enum: - 1 - 2 - 4 - 8 - 16 - 31 - 0 x-enum-varnames: - ActionRead - ActionWrite - ActionCreate - ActionDelete - ActionControl - ActionAll - ActionNone macaroon.CaveatSet: type: object properties: caveats: type: array items: type: object macaroon.Nonce: type: object properties: kid: type: array items: type: integer proof: type: boolean rnd: type: array items: type: integer ````