[bjarn]

What changed

Adds team.api_tokens, a sub-client for the team's API tokens, next to team.members and team.invites and in the same style (team token), on both Lettermint and AsyncLettermint:

Method	Request	Returns
list(query=None, *, timeout=None)	GET /team/api-tokens ({"page": {"size", "cursor"}, "sort": [...]})	ListTeamApiTokensResponse (CursorPage[TeamApiToken])
iterate(query=None, *, timeout=None)	follows next_cursor	Iterator[TeamApiToken] (AsyncIterator on the async client)
create(body, *, timeout=None)	POST /team/api-tokens with StoreTeamApiTokenData	TeamApiTokenCreatedResponse (201)
delete(token_id, *, timeout=None)	DELETE /team/api-tokens/{tokenId}	MessageResponse

• create takes a name, the abilities (for example read:domains) and an optional expires_at (ISO 8601 or None). The new token can only have abilities that the requesting token has. It copies the requesting token's IP allowlist, and it can't outlive the requesting token: expires_at defaults to, and can't be later than, its expiry.
• create returns the token value once, in data["token"]. The docstring and README say to store it right away; as with project tokens, the SDK does not redact response dicts.
• list and iterate return token metadata only. delete stops the token from working immediately; a token can only delete tokens whose abilities it also has.
• A 403 raises the existing PermissionDeniedError, a 422 the existing ValidationError. No new exception classes.
• Empty and .. token IDs are rejected before any request, as for the other methods.
• None of these operations take an Idempotency-Key, so there is no idempotency_key argument.
• TeamApiTokens and AsyncTeamApiTokens are exported, like TeamInvites.
• README: team.api_tokens is in the Team API table, with a short section and example.
• The surface test no longer has a pending list: every operation in the generated table has an SDK method again.

Stacked on #46. Non-breaking. Suggested bump: minor.

Usage

lettermint = Lettermint(team_token=os.environ["LETTERMINT_TEAM_TOKEN"])

created = lettermint.team.api_tokens.create({
    "name": "Deploys",
    "abilities": ["read:domains"],
    "expires_at": "2027-01-01T00:00:00Z",
})
print(created["data"]["token"])  # only returned once

for token in lettermint.team.api_tokens.iterate({"sort": ["name"]}):
    print(token["name"], token["abilities"], token["expires_at"])

lettermint.team.api_tokens.delete(created["data"]["id"])

Checks

On this branch:

• python -m ruff check src tests scripts: passed
• python -m ruff format --check src tests scripts: passed
• python -m mypy: no issues in 36 source files
• python scripts/unasync.py --check: _sync up to date
• python scripts/generate.py --check: generated files up to date with the pinned spec, headers OK
• python -m pytest tests/: 332 passed on Python 3.10, 3.11, 3.12, 3.13 and 3.14
• python -m build and twine check --strict dist/*: passed; the wheel installs in a fresh venv and imports (UPGRADE.md and py.typed included)

Not run locally

Nothing; every CI step was run locally.

Suggested release tag

v3.3.0 (minor), together with #46 once both are merged.