Jose Donoso wrote:error 7: reason "OPERATION_NOT_ALLOWED: for 'create' operation you should be authorized"
 Currently all API requests require sid parameter with session id. Also, "userId" parameter accepts id, not name.
I wrote full example on js (nodejs) to illustrate which requests you need to do:
const https = require('https');
const TOKEN =
    'XXXX6c5XXXX8272XXXX894a47376c1e8F2XXXX2C4XXXXAF08B231D2D60XXXX2CC4F8XXXX';
const API_URL = 'https://hst-api.wialon.com/wialon/ajax.html';
const FOR_USER = 'another';
main().catch((error) => {
    console.error('[main error]', error);
});
async function main() {
    /*
        Login with our super-token to create session for other requests
    */
    let loginResult = await apiRequest({
        svc: 'token/login',
        params: {
            token: TOKEN,
            operateAs: '',
            fl: 0,
        },
    });
    let { eid: sid, au: userName } = loginResult;
    console.log(`Authorized as ${userName}`);
    /*
        Search user by name
    */
    let searchItemsResult = await apiRequest({
        sid,
        svc: 'core/search_items',
        params: {
            spec: {
                itemsType: 'user',
                propName: 'sys_name',
                propValueMask: FOR_USER,
                sortType: '',
                propType: '',
                or_logic: false,
            },
            force: 1,
            flags: 1,
            from: 0,
            to: 1,
        },
    });
    if (searchItemsResult.items.length !== 1) {
        throw new Error(`Found ${searchItemsResult.items.length} users`);
    }
    let { id: userId, nm: foundUserName } = searchItemsResult.items[0];
    /*
        Create token for found user
    */
    let createTokenResult = await apiRequest({
        sid,
        svc: 'token/update',
        params: {
            callMode: 'create',
            userId,
            app: 'Forum example',
            at: 0,
            dur: 300,
            fl: 2,
            p: '{}',
        },
    });
    console.log(
        `Token for user "${foundUserName}" (id${userId}) created: ${createTokenResult.h}`,
    );
    /*
        Logout to cleanup session
    */
    await apiRequest({
        sid,
        svc: 'core/logout',
        params: {},
    });
}
/*
    Function that does API-call
*/
function apiRequest({ svc, params, sid }) {
    return new Promise((resolve, reject) => {
        let req = https.request(
            `${API_URL}?svc=${encodeURIComponent(svc)}`,
            {
                method: 'POST',
                headers: {
                    'content-type': 'application/x-www-form-urlencoded',
                },
            },
            (res) => {
                let buffers = [];
                let totalLength = 0;
                res.on('error', reject);
                res.on('data', (data) => {
                    buffers.push(data);
                    totalLength += data.length;
                });
                res.on('end', () => {
                    let result;
                    try {
                        result = JSON.parse(
                            Buffer.concat(buffers, totalLength),
                        );
                    } catch (error) {
                        reject(error);
                        return;
                    }
                    if (!result) {
                        reject(new Error('no data'));
                        return;
                    }
                    if (result.error) {
                        reject(result);
                        return;
                    }
                    resolve(result);
                });
            },
        );
        req.on('error', reject);
        let bodyParams = [];
        if (sid) {
            bodyParams.push(['sid', encodeURIComponent(sid)]);
        }
        bodyParams.push(['params', encodeURIComponent(JSON.stringify(params))]);
        req.end(bodyParams.map((x) => x.join('=')).join('&'));
    });
}