# October 15, 2026: Agent Name Service (ANS) scopes are now available for Personal Access Tokens (https://developer.godaddy.com/en/docs/api-users/changelog/ans-pat-scopes)

---
title: >-
  October 15, 2026: Agent Name Service (ANS) scopes are now available for
  Personal Access Tokens
---

October 15, 2026
PAT
ANS

Changed

You can now generate a Personal Access Token (PAT) with Agent Name Service (ANS) scopes and use it to call the ANS API, so you can register and manage agents with a scoped, revocable credential instead of a classic developer key.

## What changed

The **Permissions** field on the Generate Personal Access Token page has a new **Agent Name Service** category with two scopes:

* `ans.agent-registration:read` (Read Agents) — read agents, certificates, certificate signing request (CSR) and renewal status, and agent events; resolve ANS names; search registered agents.
* `ans.agent-registration:write` (Manage Agents) — register, verify, revoke, and renew agents and certificates. It implies `ans.agent-registration:read`, so a write-only token can call every ANS operation.

Every ANS API reference page now lists the scope each operation accepts. Write operations such as [`POST /v1/agents/register`](https://developer.godaddy.com/docs/references/rest/ans/register-agent) and [`POST /v1/agents/{agentId}/revoke`](https://developer.godaddy.com/docs/references/rest/ans/revoke-agent) require `ans.agent-registration:write`. Read operations, including [`POST /v1/agents/resolution`](https://developer.godaddy.com/docs/references/rest/ans/resolve-ans-name) and [`GET /v1/agents/events`](https://developer.godaddy.com/docs/references/rest/ans/get-agent-events), accept either scope.

Send the token on every request as `Authorization: Bearer $GODADDY_PAT`.

## Who is affected

Developers calling the ANS API who want to use a PAT. Tokens generated before this change don't include ANS access; generate a new token with the ANS scopes.

Existing integrations are unaffected. The classic developer key (`sso-key {KEY}:{SECRET}`) continues to work on every ANS operation, and scopes don't apply to it. The three registered-agent search operations ([search](https://developer.godaddy.com/docs/references/rest/ans/search-registered-agents), [list](https://developer.godaddy.com/docs/references/rest/ans/list-registered-agents), and [retrieve](https://developer.godaddy.com/docs/references/rest/ans/get-registered-agent)) also accept anonymous requests when you omit the `Authorization` header, limited to 60 requests per minute per client IP; a PAT raises that to 3000. Scopes for other APIs are unchanged, and no action is required.

## Links

* [Generate a PAT](https://developer.godaddy.com/docs/api-users/auth/how-to#generate-a-token) — create a token and select the Agent Name Service scopes
* [PAT scopes](https://developer.godaddy.com/docs/api-users/auth#pat-scopes) — how scopes work, including why a write scope satisfies read operations
* [Register a new agent with the ANS](https://developer.godaddy.com/docs/references/rest/ans/register-agent) — write-scope operation reference
* [Resolve an ANSName to an endpoint](https://developer.godaddy.com/docs/references/rest/ans/resolve-ans-name) — read-scope operation reference
* [Search registered agents](https://developer.godaddy.com/docs/references/rest/ans/search-registered-agents) — search reference, including anonymous access