Mint a Passport personal access token issued AS the owner user of a given account (account-owner impersonation), for server-to-server calls to account-scoped endpoints on behalf of a tenant account. Rotates: every other non-revoked token of the same name for that owner is revoked on each mint (at most one active account-owner token per owner).

Auth: Partner — authentication, inside the partner/ prefix; partner-agnostic (any partner, not only hipages — no partner-only access on this route). The endpoint gates the caller in-controller: the auth user's person.company must exist and have bundle_id === 1 (partner), else 403 Only partner users can mint brand-owner tokens. The target account_id must resolve to a Company with bundle_id === 3 (an account) — else 404 Company is not a brand. — and must descend from the caller's partner tree, else 403 Brand is not under your partner tree. The account must have an owner user (getOwnerUser), else 404.

Rate limit: No rate limit.

Request

• Body:

Response — { data. } envelope.

• status (string) — success.
• token (string) — the issued Passport access token, usable as a bearer token for the account owner.
• account_owner (object):
• user_id (integer) — the account owner's user id.
• account_id (integer) — the account company id.
• expires_at (string|null) — ISO-8601 token expiry, or null when no Passport TTL is configured.
• prior_tokens_revoked (integer) — count of older same-name tokens revoked by this mint (rotation).