# List API tokens

Every API token of the organization, including revoked ones (`revokedAt` set).

`GET /tokens`

Auth **Console session** | Role **Owner or Manager**

Every API token of the organization, including revoked ones (`revokedAt` set). The secret value is never returned after creation; `prefix` is the first visible characters, for recognising a token. Requires a console session of an Owner or Manager.

## Returns

The `data` field of the standard `{ data, error, meta }` envelope:

An array of object:
- `tokenId`: string Token id.
- `name`: string Name given at creation.
- `prefix`: string First visible characters of the secret, to recognise the token.
- `scopes`: array of string
  - `sbom:read`
  - `sbom:write`
  - `mcp:read`
  - `mcp:write`
  - `supplier_template:read`
  - `supplier_template:write`
  - `pii:read`
  - `jml:read`
  - `asset:read`
  - `risk:read`
  - `supplier:read`
  - `iso:read`
  - `compliance:read`
  - `evidence:read`
  - `access_review:read`
  - `employee:read`
  - `audit_log:read`
  - `audit_log:verify`
- `expiresAt`: optional string (date-time) Expiry; absent for a token that does not expire.
- `revokedAt`: optional string (date-time) Set once the token is revoked.
- `revokedBy`: optional string User id of who revoked it.
- `lastUsedAt`: optional string (date-time) Last successful use; absent if never used.
- `suspendedAt`: optional string (date-time) Set when the token was suspended because its creator no longer holds the role its scopes require. A suspended token is refused like a revoked one and is not resumed.
- `suspendedReason`: optional string Why the token was suspended.
- `activity`: optional object Usage of the token on the current UTC day. Absent until the token has been used.
  - `day`: string UTC date, YYYY-MM-DD.
  - `requests`: integer Requests made that day.
  - `rows`: integer Data rows returned that day.
  - `distinctRoutes`: integer Number of distinct routes called that day (capped at 50).
  - `lastIp`: string Client address of the last request.
  - `lastRouteId`: string Route template of the last request.
  - No other fields.
- `createdBy`: string User id of the creator.
- `createdAt`: string (date-time)
- `updatedAt`: string (date-time)
- No other fields.

## Errors

| Status | Code | Retry | Meaning |
|---|---|---|---|
| 401 | `UNAUTHORIZED` | no | No signed-in session. code UNAUTHORIZED. |
| 403 | `FORBIDDEN` | no | The caller is not an Owner or Manager of the organization, or the request carries an API token (FORBIDDEN), or the session is a support session (SUPPORT_SESSION_NO_MINT on create and revoke). |
| 500 | `DB_ERROR` | no | Unexpected server error. code DB_ERROR or TOKEN_GENERATION_FAILED; retry later and quote error.id if it persists. |

## Example

### curl

```bash
curl "https://api.autociso.io/api/v1/tokens" \
  -H "Authorization: Bearer <console-session-token>"
```

### Python

```python
import requests

response = requests.get(
    "https://api.autociso.io/api/v1/tokens",
    headers={"Authorization": "Bearer <console-session-token>"},
)
print(response.json())
```

### JavaScript

```javascript
const response = await fetch("https://api.autociso.io/api/v1/tokens", {
  method: "GET",
  headers: { "Authorization": "Bearer <console-session-token>" },
});
console.log(await response.json());
```

## Response (200)

```json
{
  "data": [
    {
      "tokenId": "tok_1hgyun41rx48",
      "name": "GitHub Actions SBOM upload",
      "prefix": "aci_XXXX",
      "scopes": [
        "sbom:write"
      ],
      "lastUsedAt": "2026-10-08T03:12:44Z",
      "activity": {
        "day": "2026-10-08",
        "requests": 42,
        "rows": 1180,
        "distinctRoutes": 3,
        "lastIp": "203.0.113.7",
        "lastRouteId": "/api/v1/sscs/sboms"
      },
      "createdBy": "usr_1hgyq2mw7c3k",
      "createdAt": "2026-09-02T10:00:00Z",
      "updatedAt": "2026-10-08T03:12:44Z"
    },
    {
      "tokenId": "tok_1hgz02bd9k1p",
      "name": "HR leaver sync",
      "prefix": "aci_YYYY",
      "scopes": [
        "jml:read"
      ],
      "expiresAt": "2027-10-01T00:00:00Z",
      "revokedAt": "2026-10-05T08:30:00Z",
      "revokedBy": "usr_1hgyq2mw7c3k",
      "createdBy": "usr_1hgyq2mw7c3k",
      "createdAt": "2026-09-15T12:00:00Z",
      "updatedAt": "2026-10-05T08:30:00Z"
    }
  ]
}
```