    async def post(self, user_name, server_name=None):
        """POST creates a new share code"""

        if server_name is None:
            # only GET supported `/share-codes/{user}` without specified server
            raise web.HTTPError(405)

        model = self.get_json_body() or {}
        try:
            request = ShareCodeGrantRequest(**model)
        except ValidationError as e:
            raise web.HTTPError(400, str(e))

        scopes = request.scopes
        # check scopes
        if not scopes:
            # default scopes
            scopes = [f"access:servers!server={user_name}/{server_name}"]

        try:
            scopes = orm.ShareCode._apply_filter(
                frozenset(scopes), user_name, server_name
            )
        except ValueError as e:
            raise web.HTTPError(400, str(e))

        # validate that scopes may be granted by requesting user
        for scope in scopes:
            if not self.has_scope(scope):
                raise web.HTTPError(
                    403, f"Do not have permission to grant share with scope {scope}"
                )

        # resolve target spawner
        spawner = self._lookup_spawner(user_name, server_name)

        # issue the code
        (share_code, code) = orm.ShareCode.new(
            self.db, spawner, scopes=scopes, expires_in=request.expires_in
        )
        # return the model (including code only this one time when it's created)
        self.finish(json.dumps(self.share_code_model(share_code, code=code)))
POST creates a new share code
jupyterhub/apihandlers/shares.py