From 0115680129b0910bf95268a6a17e3c6e59fec83b Mon Sep 17 00:00:00 2001 From: Thomas Moraine Date: Wed, 9 Sep 2026 15:22:57 +0200 Subject: [PATCH] doc(restapi.md): document maximum token validity (#10347) --- docs/docs/automation/restapi.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/docs/docs/automation/restapi.md b/docs/docs/automation/restapi.md index 65f3040cbd..fbd72aef61 100644 --- a/docs/docs/automation/restapi.md +++ b/docs/docs/automation/restapi.md @@ -63,6 +63,15 @@ curl -X POST -u admin@admin.net:admin https://xo.example.org/rest/v0/users/me/au If you don't know your user ID, use the `me` alias, as above. Tokens expire (see the `expiration` timestamp): before that happens, renew by calling the same endpoint with your existing token to create a fresh one. ::: +#### Maximum token validity + +The maximum validity period for authentication tokens is controlled by the `maxTokenValidity` setting in the XO configuration file (`config.toml`): + +``` +[authentication] +maxTokenValidity = '0.5 year' +``` + ## Reading a collection {#collections-request} Every object type lives in a collection at `/rest/v0/` (e.g. `/rest/v0/vms`, `/rest/v0/hosts`, `/rest/v0/srs`). A plain `GET` returns the objects' URLs, and the following query parameters shape the result: