The `tmp.json` contains the access rights that are needed to create tokens and the `run.bash` show how to add this via Graylog API and assing a user to this role.

run.bash

http -a admin POST https://nuci3.local.lan/graylog/api/roles < tmp.json
http: password for admin@nuci3.local.lan:
HTTP/1.1 201 Created
Connection: keep-alive
Content-Length: 206
Content-Type: application/json
Date: Tue, 15 May 2018 13:30:08 GMT
Location: http://10.10.10.100:9000/graylog/api/roles/User%20Token%20Mangement
Server: nginx/1.12.2
Strict-Transport-Security: max-age=63072000; includeSubdomains; preload
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-Graylog-Node-ID: 20180124-0000-gles-multi-nodecluster01

{
    "description": "User can list, create and remove thier token in the Graylog server",
    "name": "User Token Mangement",
    "permissions": [
        "users:tokenremove",
        "users:tokenlist",
        "users:tokencreate"
    ],
    "read_only": false
}


http -a admin PUT https://nuci3.local.lan/graylog/api/roles/User%20Token%20Mangement/members/hulle
http: password for admin@nuci3.local.lan:
HTTP/1.1 204 No Content
Connection: keep-alive
Date: Tue, 15 May 2018 13:40:56 GMT
Server: nginx/1.12.2
Strict-Transport-Security: max-age=63072000; includeSubdomains; preload
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-Graylog-Node-ID: 20180124-0000-gles-multi-nodecluster01



http -a hulle POST https://nuci3.local.lan/graylog/api/users/hulle/tokens/token
http: password for hulle@nuci3.local.lan:
HTTP/1.1 200 OK
Connection: keep-alive
Content-Length: 119
Content-Type: application/json
Date: Tue, 15 May 2018 13:43:44 GMT
Server: nginx/1.12.2
Strict-Transport-Security: max-age=63072000; includeSubdomains; preload
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-Graylog-Node-ID: 20180124-0000-gles-multi-nodecluster02

{
    "last_access": "1970-01-01T00:00:00.000Z",
    "name": "token",
    "token": "b7nslr60ac4nd7muf6d0v9im2k676nev2h2e68085a6aol12a7e"
}

tmp.json

{
 "read_only": false,
 "permissions": [
  "users:tokenlist",
  "users:tokencreate",
  "users:tokenremove"
 ],
 "name": "User Token Mangement",
 "description": "User can list, create and remove thier token in the Graylog server"
}