Personal Access Tokens

Personal Access Tokens are user-owned credentials for the Hamstik CLI, scripts, agents, and other automation. Create them from Account → Developer Settings.

When creating a token:

give it a recognizable name;
select only the scopes it needs;
choose all resources you can access or restrict it to Organizations and/or Projects;
choose an expiration from 1 to 365 days. The account UI defaults to 90 days.

The account scope picker includes organization:members:read, work_item:delete, profile:read, report:read, and report:write but does not preselect them for new tokens; the current defaults for existing scopes are preserved. Existing PAT rows remain valid with their stored capabilities. PAT scopes cannot be edited: create and verify a replacement token with the new scope, then revoke the old token.

When two-factor authentication is enabled, creating a token requires that you recently completed MFA; tokens already issued are not revoked or changed when 2FA is enabled. PATs are noninteractive, so they never trigger an MFA challenge. See Account security and two-factor authentication for the sign-in and recovery behavior.

project:write includes project:read, milestone:write includes milestone:read, work_item:write includes work_item:read, work_item:delete includes work_item:write and work_item:read, comment:write includes comment:read, and comment:delete includes comment:read, and both attachment:write and attachment:delete include attachment:read. organization:members:read and profile:read imply nothing. report:write includes report:read, and quality:write includes quality:read. No other scope is implied. A PAT never grants an Organization role or membership: effective access is the intersection of the token’s scopes, its resource restrictions, and the user’s current Hamstik authorization.

The complete token is shown exactly once after creation. Copy it immediately and store it in a secure credential store. Hamstik stores only a selector and a SHA-256 digest, so the secret cannot be recovered from the token list. Later lists show metadata, scopes, restrictions, expiration, revocation, and last-use time, but never the token or its hash.

Revoking a token takes effect on the next request. Removing the owning account revokes all of its tokens. A successful request updates last-used metadata at most about once every 15 minutes.

Example:

curl \
  -H "Authorization: Bearer $HAMSTIK_TOKEN" \
  https://hamstik.com/api/v1/me

Scope and resource matrix

Operation	Scope
List or read Organizations and discover Organization Attribute definitions	`organization:read`
List active Organization members	`organization:members:read`
Read Organization retention policy, revisions, impact previews, and governance delegation	`governance:read`
Create policy revisions, generate previews, and grant or revoke governance capabilities	`governance:write`
List or read Projects	`project:read`
List/read Organization Milestones and accessible member Releases	`milestone:read`
Create/edit/transition Milestones or change Release membership	`milestone:write`
Read/execute Advanced reports and dashboards; read exact selections	`report:read`
Create, replace, or delete Advanced report definitions	`report:write`
Read Standard Project and Sprint reports (Core)	`project:read`
List or read your own private calendar feeds for a Project	`calendar:read`
Create, update, rotate, or revoke your own private calendar feeds	`calendar:write`
Create Projects	`project:write`
Create Project labels, Sprints, and Project lifecycle mutations	`project:write`
List or read Work Items; discover transitions; read watcher state	`work_item:read`
Create or update Work Items; transition status; watch, unwatch, mute, or unmute	`work_item:write`
Delete, archive, or unarchive Work Items	`work_item:delete`
Read authenticated profiles, profile work, and profile activity	`profile:read`
List comments	`comment:read`
Create comments	`comment:write`
Delete your comments with no replies	`comment:delete`
List or download Work Item attachments	`attachment:read`
Upload Work Item attachments	`attachment:write`
Delete Work Item attachments	`attachment:delete`
Update Projects and archive/unarchive Projects	`project:write`
Bulk create, update, or transition Work Items	`work_item:write`
Create or delete Work Item links and assign/remove labels	`work_item:write`
Read Work Item and Project activity	`work_item:read`
Edit authored comments, including server-resolved `@username` mentions	`comment:write`
Administer Organization Attribute definitions/options	`attribute:write` plus current Organization Owner or Administrator role
Enable or disable an Organization Attribute for a Project	`attribute:write`, that Project’s resource grant, and current Project-management authorization

attribute:write is standalone and implies no read or other write scope. Mutation scopes imply their matching read scope. A restricted PAT can be granted specific Organizations or Projects. An Organization grant includes its current and future Projects; a Project grant includes only that Project and may expose its parent Organization as the minimum context needed to address it.

Every request still checks the user’s current membership and role. Removing a user’s membership takes effect immediately for existing PATs, and a suspended Organization cannot be accessed by presenting a PAT.

PAT scope grants are immutable. To obtain a newly introduced scope, create a replacement PAT with that scope, verify the replacement, and then revoke the old PAT.

profile:read authorizes only the authenticated profile resources and does not create an anonymous directory. organization:members:read authorizes the active member directory. A Project-restricted PAT may use that directory only when it has at least one granted Project in the Organization. Profile visibility, Work Item involvement, statistics, activity, and pagination are all narrowed by the same Organization/Project grant intersection before any response is serialized.

Advanced scopes do not bypass Premium/App/capability gates. Project-only PATs project every Advanced source and execution to their granted Projects and must use selected Projects in mutations. See Advanced Reporting API.