docs

List API tokens

GET /tokens

Auth Console session Role Owner or Manager

Every API token of the organization, including revoked ones (revokedAt set). The secret value is never returned after creation; prefix is the first visible characters, for recognising a token. Requires a console session of an Owner or Manager.

Example

curl "https://api.autociso.io/api/v1/tokens" \
  -H "Authorization: Bearer <console-session-token>"

Response 200

{
  "data": [
    {
      "tokenId": "tok_1hgyun41rx48",
      "name": "GitHub Actions SBOM upload",
      "prefix": "aci_XXXX",
      "scopes": [
        "sbom:write"
      ],
      "lastUsedAt": "2026-10-08T03:12:44Z",
      "activity": {
        "day": "2026-10-08",
        "requests": 42,
        "rows": 1180,
        "distinctRoutes": 3,
        "lastIp": "203.0.113.7",
        "lastRouteId": "/api/v1/sscs/sboms"
      },
      "createdBy": "usr_1hgyq2mw7c3k",
      "createdAt": "2026-09-02T10:00:00Z",
      "updatedAt": "2026-10-08T03:12:44Z"
    },
    {
      "tokenId": "tok_1hgz02bd9k1p",
      "name": "HR leaver sync",
      "prefix": "aci_YYYY",
      "scopes": [
        "jml:read"
      ],
      "expiresAt": "2027-10-01T00:00:00Z",
      "revokedAt": "2026-10-05T08:30:00Z",
      "revokedBy": "usr_1hgyq2mw7c3k",
      "createdBy": "usr_1hgyq2mw7c3k",
      "createdAt": "2026-09-15T12:00:00Z",
      "updatedAt": "2026-10-05T08:30:00Z"
    }
  ]
}

Returns

The data field of the standard { data, error, meta } envelope:

An array of object:

  • tokenId string required
    Token id.
  • name string required
    Name given at creation.
  • prefix string required
    First visible characters of the secret, to recognise the token.
  • scopes array of string required
    18 values
    "sbom:read" | "sbom:write" | "mcp:read" | "mcp:write" | "supplier_template:read" | "supplier_template:write" | "pii:read" | "jml:read" | "asset:read" | "risk:read" | "supplier:read" | "iso:read" | "compliance:read" | "evidence:read" | "access_review:read" | "employee:read" | "audit_log:read" | "audit_log:verify"
  • expiresAt string (date-time)
    Expiry; absent for a token that does not expire.
  • revokedAt string (date-time)
    Set once the token is revoked.
  • revokedBy string
    User id of who revoked it.
  • lastUsedAt string (date-time)
    Last successful use; absent if never used.
  • suspendedAt string (date-time)
    Set when the token was suspended because its creator no longer holds the role its scopes require. A suspended token is refused like a revoked one and is not resumed.
  • suspendedReason string
    Why the token was suspended.
  • activity object
    Usage of the token on the current UTC day. Absent until the token has been used.
    • day string required
      UTC date, YYYY-MM-DD.
    • requests integer required
      Requests made that day.
    • rows integer required
      Data rows returned that day.
    • distinctRoutes integer required
      Number of distinct routes called that day (capped at 50).
    • lastIp string required
      Client address of the last request.
    • lastRouteId string required
      Route template of the last request.
    • No other fields.
  • createdBy string required
    User id of the creator.
  • createdAt string (date-time) required
  • updatedAt string (date-time) required
  • No other fields.

Errors

Status Code Retry Meaning
401 UNAUTHORIZED no No signed-in session. code UNAUTHORIZED.
403 FORBIDDEN no The caller is not an Owner or Manager of the organization, or the request carries an API token (FORBIDDEN), or the session is a support session (SUPPORT_SESSION_NO_MINT on create and revoke).
500 DB_ERROR no Unexpected server error. code DB_ERROR or TOKEN_GENERATION_FAILED; retry later and quote error.id if it persists.
Last reviewed: 2026-10-13

Was this page helpful?

Esc