List csrf
IssueCSRFToken mints the anti-forgery token a browser echoes as X-CSRF-Token on every change it asks for.
GET /v1/account/csrf
| Address | https://api.hanzo.ai/v1/account/csrf |
| Method | GET |
| Operation | get_account_csrf |
| Auth | Authorization: Bearer $HANZO_API_KEY |
IssueCSRFToken mints the anti-forgery token a browser echoes as X-CSRF-Token on every change it asks for. The token is bound to the caller's validated identity and expires, so one minted for one identity cannot authorize a change as another.
It is answered no-store, so it is never cached by a shared proxy. This is the same-origin endpoint the embedded console reads — the Same-Origin Policy is what stops a cross-site page from reading the response and forging a change.
Request
GET /v1/account/csrf takes no parameters and no body — the credential is the whole request.
Response
| Status | Body | Meaning |
|---|---|---|
200 | csrfResp | ok |
200 body — 2 fields.
| Field | In | Type | Always | Description |
|---|---|---|---|---|
csrfToken | body | string | — | Token is the value to send back in the X-CSRF-Token header. |
expiresIn | body | integer | — | ExpiresIn is the token's lifetime in seconds. |
Failure carries the platform error shape — see Errors.
Examples
hanzo account csrfimport { Configuration, AccountApi } from 'hanzoai';
const api = new AccountApi(new Configuration({ accessToken: process.env.HANZO_API_KEY }));
const { data } = await api.getAccountCsrf();from hanzoai.cloud import ApiClient, Configuration
from hanzoai.cloud.api import AccountApi
client = ApiClient(Configuration(access_token=os.environ["HANZO_API_KEY"]))
result = AccountApi(client).get_account_csrf()cfg := cloud.NewConfiguration()
cfg.AddDefaultHeader("Authorization", "Bearer "+os.Getenv("HANZO_API_KEY"))
client := cloud.NewAPIClient(cfg)
resp, _, err := client.AccountAPI.GetAccountCsrf(context.Background()).Execute()
if err != nil {
return err
}use hanzo_cloud::apis::{configuration::Configuration, account_api};
let mut cfg = Configuration::new();
cfg.bearer_access_token = std::env::var("HANZO_API_KEY").ok();
let result = account_api::get_account_csrf(&cfg, Default::default()).await?;import ai.hanzo.cloud.ApiClient;
import ai.hanzo.cloud.api.AccountApi;
ApiClient client = new ApiClient();
client.setRequestInterceptor(b -> b.header("Authorization", "Bearer " + System.getenv("HANZO_API_KEY")));
var result = new AccountApi(client).getAccountCsrf();curl https://api.hanzo.ai/v1/account/csrf \
-H "Authorization: Bearer $HANZO_API_KEY"MCP reaches account through the account tool, which names its 8 operations with its own verbs — this one among them, under a name only MCP declares. describe explains any of them:
curl -X POST https://api.hanzo.ai/v1/mcp \
-H "Content-Type: application/json" \
-d '{
"jsonrpc": "2.0",
"id": 1,
"method": "tools/call",
"params": {
"name": "describe",
"arguments": {
"op": "get_appearance"
}
}
}'How is this guide?