Auth Token

The Auth Token endpoint generates or resets temporary login tokens for web users and extension web identities. The generated token can be used in place of the user password on the MiRTA PBX login page.

Authentication Scope

This endpoint always requires the global full API key. Tenant API keys and read-only API keys are rejected. The token is returned only once when it is generated, so store it securely in the calling system if it needs to be delivered to the user.

Operation	Path	API key
Generate token	POST https://pbx.example.com/pbx/openapi.php/auth/token	GLOBAL_API_KEY
Reset token	DELETE https://pbx.example.com/pbx/openapi.php/auth/token	GLOBAL_API_KEY

Supported Identities

The user value is resolved in the same order as the legacy ProxyAPI token feature: MiRTA PBX web users first, then extension web users, then SIP extension usernames, then PJSIP endpoint IDs when the extension does not have a separate web user.

Identity type	Matched field
Web user	us_users.us_username
Extension web user	ex_extensions.ex_webuser
SIP extension username	sipfriends.name when ex_webuser is empty
PJSIP endpoint ID	ps_endpoints.id when ex_webuser is empty

Generate Token

Use validity set to ONCE for a single-use token, or provide a date/time string to make the token valid until that time.

curl -X POST \
  -H "X-API-Key: GLOBAL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"user":"100","validity":"ONCE"}' \
  "https://pbx.example.com/pbx/openapi.php/auth/token"

Successful response:

{
  "token": "generated-token-value",
  "user": "100",
  "target_type": "WEBPASSWORD"
}

Generate Expiring Token

curl -X POST \
  -H "X-API-Key: GLOBAL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"user":"api.operator","validity":"2026-06-30 23:59:59"}' \
  "https://pbx.example.com/pbx/openapi.php/auth/token"

Reset Token

Resetting a token clears the stored token hash and validity for the resolved user identity.

curl -X DELETE \
  -H "X-API-Key: GLOBAL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"user":"100"}' \
  "https://pbx.example.com/pbx/openapi.php/auth/token"

Successful response:

{
  "reset": true,
  "user": "100",
  "target_type": "WEBPASSWORD"
}

Important Notes

• Only the generated token value is returned. MiRTA PBX stores a SHA-256 hash of the token.
• A single-use token is cleared after a successful login.
• Generating a new token replaces any previous token for that user identity.
• This endpoint manages login tokens only. It does not create or rotate OpenAPI API keys.

Common Errors

Error	Meaning
missing_api_key	No API key was supplied in the query string, X-API-Key, or bearer token.
invalid_api_key	The supplied key does not match a valid API key.
admin_required	A global API key is required.
read_only_api_key	The supplied key is read-only and cannot generate or reset tokens.
missing_user	The request body did not include a user value.
invalid_validity	The validity value was not ONCE and could not be parsed as a date/time.
user_not_found	No supported web user or extension identity matched the requested user value.