Generate tokens
const url = 'https://api.retorio.com/be/v2/cohorts/b2d7e4a1_55c3_4f28_9e10_7a3d6c4b8f02/participants/tokens';const options = { method: 'POST', headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'}, body: '{"numberTokens":25}'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request POST \ --url https://api.retorio.com/be/v2/cohorts/b2d7e4a1_55c3_4f28_9e10_7a3d6c4b8f02/participants/tokens \ --header 'Authorization: Bearer <token>' \ --header 'Content-Type: application/json' \ --data '{ "numberTokens": 25 }'Generates new access tokens for a token-type cohort, to hand to coaching users directly instead of inviting them by email: through your own LMS, HR system, or in person. The response has no body: fetch the generated tokens with GET /cohorts/{id}/participants right after. A token is meant to be redeemed once and does not expire on its own. Redeeming it replaces the token value, so the participant list then shows a different token for that user than the one handed out. Match on userId, not on the token. Each token has its own user (userId in the participant list). Removing that user with DELETE /cohorts/participants revokes the token.
Authentication
Section titled “Authentication”- Auth
- Access key
- Roles
- Owner / Admin / Custom
Parameters
Section titled “Parameters”Path Parameters
Section titled “Path Parameters”Example
b2d7e4a1_55c3_4f28_9e10_7a3d6c4b8f02Request Bodyrequired
Section titled “Request Bodyrequired”object
How many new tokens to generate, 1 to 200 per call.
Example
25Responses
Section titled “Responses”Generated
The request body is not valid, or the cohort is not of type token. Also answered when the request body is not valid JSON.
object
Canonical error name, e.g. INVALID_ARGUMENT.
object
The HTTP reason phrase, e.g. Bad Request.
Example generated
{ "message": "example", "status": "example", "details": "example"}Not authenticated: the bearer token is missing, malformed, expired or revoked, its sign-in method does not match your organization’s configuration, the user it belongs to was removed, or your organization is deactivated.
object
Canonical error name, e.g. INVALID_ARGUMENT.
Example generated
{ "message": "example", "status": "example", "details": "example"}Refused: the token does not belong to an admin, or your organization does not have the coaching product, or the admin’s roles do not grant coaching-users:manage.
object
Canonical error name, e.g. INVALID_ARGUMENT.
object
object
The HTTP reason phrase, e.g. Bad Request.
Example generated
{ "message": "example", "status": "example", "details": "example"}No cohort with this id in your organization.
object
Canonical error name, e.g. INVALID_ARGUMENT.
Example generated
{ "message": "example", "status": "example", "details": "example"}The request body is larger than 10 MB.
object
The HTTP reason phrase, e.g. Bad Request.
Example generated
{ "statusCode": 1, "message": "example", "error": "example"}The Content-Type charset or the Content-Encoding is one the API cannot decode. Send UTF-8 JSON without a content encoding.
object
The HTTP reason phrase, e.g. Bad Request.
Example generated
{ "statusCode": 1, "message": "example", "error": "example"}Internal Server Error
object
Example generated
{ "additionalProperty": "example"}Retorio is GDPR and DSGVO compliant, EU AI Act aligned, ISO 27001 certified, and hosted on Google Cloud with EU data residency. For anything specific to your rollout, ask your Retorio contact.