@webapi_check_local_site
    @webapi_login_required
    @webapi_response_errors(DOES_NOT_EXIST, INVALID_FORM_DATA, NOT_LOGGED_IN,
                            PERMISSION_DENIED, TOKEN_GENERATION_FAILED)
    @webapi_request_fields(
        required={
            'note': {
                'type': six.text_type,
                'description': 'The note explaining the purpose of '
                               'this token.',
            },
            'policy': {
                'type': six.text_type,
                'description': 'The token access policy, encoded as a '
                               'JSON string.',
            },
        },
        allow_unknown=True
    )
    def create(self, request, note, policy, extra_fields={},
               local_site_name=None, *args, **kwargs):
        """Registers a new API token.

        The token value be generated and returned in the payload.

        Callers are expected to provide a note and a policy.

        Note that this may, in theory, fail due to too many token collisions.
        If that happens, please re-try the request.
        """
        try:
            user = resources.user.get_object(request, *args, **kwargs)
        except __HOLE__:
            return DOES_NOT_EXIST

        if not self.has_list_access_permissions(request, *args, **kwargs):
            return self.get_no_access_error(request)

        try:
            self._validate_policy(policy)
        except ValueError as e:
            return INVALID_FORM_DATA, {
                'fields': {
                    'policy': six.text_type(e),
                },
            }

        local_site = self._get_local_site(local_site_name)

        try:
            token = WebAPIToken.objects.generate_token(user,
                                                       note=note,
                                                       policy=policy,
                                                       local_site=local_site)
        except WebAPITokenGenerationError as e:
            return TOKEN_GENERATION_FAILED.with_message(six.text_type(e))

        if extra_fields:
            self.import_extra_data(token, token.extra_data, extra_fields)
            token.save()

        return 201, {
            self.item_result_key: token,
        }
dataset/ETHPy150Open reviewboard/reviewboard/reviewboard/webapi/resources/api_token.py/APITokenResource.create