Skip to content

List the caller's personal tokens without secrets.

GET
/api/v1/tokens

List the authenticated account’s personal token metadata; default page size 50, maximum 100.

Credential scopes: tokens:manage

Resource authority: Authenticated account manages its own personal credentials; no model-user or connector role is required.

Retry: Repeat inventory GET safely. Token issuance is not an idempotent reservation; after uncertainty inspect inventory before issuing another token.

Guards: Requested scopes cannot exceed parent scopes and expiration cannot exceed parent lifetime.

Retain: Account, token ID/name/scopes and inventory cursor; token secret is returned only at issuance.

Specific failures: 403 insufficient_scope or scope_escalation; 422 invalid_token_request

Next action: Save issued secret privately; inventory never reveals it. Worked workflow

limit
integer
default: 50 >= 1 <= 100
cursor
string
<= 128 characters

Continuation from next_cursor; management collections also accept after.

List the caller’s personal tokens without secrets.

Media typeapplication/json
object
items
required
Array<object>
object
created_at
required
string format: date-time
expires_at
required
string | null format: date-time
id
required
string format: uuid
name
required
string
revoked_at
required
string | null format: date-time
scopes
required

Current retained scopes, including ‘’ for operator-issued credentials. Delegated issuance never accepts ‘’.

Array<string>
>= 1 items <= 32 items
Allowed values: me:read models:read models:manage runs:create runs:read runs:cancel uploads:create uploads:read uploads:complete artifacts:read artifacts:download connectors:read connectors:manage access:manage tokens:manage audit:read service:read service:manage *
next_cursor
required
string | null format: uuid

Examples

empty-token-inventory

Inventory never returns a secret. Issuance returns the secret only once. Values are inert fixtures.

{
"items": [],
"next_cursor": null
}
Cache-Control
string

No-store

x-request-id
string

Always present. A fresh server-generated UUID for this request; incoming IDs are ignored. On errors, this equals the response body’s request_id.

Malformed request.

Media typeapplication/json

The common JSON body for errors returned by the HTTP application.

object
code
required

Stable machine-readable error code.

string
details
One of:
null
message
required

Safe explanation without internal errors or submitted input values.

string
request_id
required

Matches the response’s x-request-id header.

string
Cache-Control
string

No-store

x-request-id
string

Always present. A fresh server-generated UUID for this request; incoming IDs are ignored. On errors, this equals the response body’s request_id.

Valid active credential required; connector and user credentials are separate.

Media typeapplication/json

The common JSON body for errors returned by the HTTP application.

object
code
required

Stable machine-readable error code.

string
details
One of:
null
message
required

Safe explanation without internal errors or submitted input values.

string
request_id
required

Matches the response’s x-request-id header.

string
Cache-Control
string

No-store

x-request-id
string

Always present. A fresh server-generated UUID for this request; incoming IDs are ignored. On errors, this equals the response body’s request_id.

The token does not permit this operation.

Media typeapplication/json

The common JSON body for errors returned by the HTTP application.

object
code
required

Stable machine-readable error code.

string
details
One of:
null
message
required

Safe explanation without internal errors or submitted input values.

string
request_id
required

Matches the response’s x-request-id header.

string
Cache-Control
string

No-store

x-request-id
string

Always present. A fresh server-generated UUID for this request; incoming IDs are ignored. On errors, this equals the response body’s request_id.

Resource absent or outside the caller’s authority.

Media typeapplication/json

The common JSON body for errors returned by the HTTP application.

object
code
required

Stable machine-readable error code.

string
details
One of:
null
message
required

Safe explanation without internal errors or submitted input values.

string
request_id
required

Matches the response’s x-request-id header.

string
Cache-Control
string

No-store

x-request-id
string

Always present. A fresh server-generated UUID for this request; incoming IDs are ignored. On errors, this equals the response body’s request_id.

Concurrent generation/publication change, conflicting retry, or a publication awaiting connector validation.

Media typeapplication/json

The common JSON body for errors returned by the HTTP application.

object
code
required

Stable machine-readable error code.

string
details
One of:
null
message
required

Safe explanation without internal errors or submitted input values.

string
request_id
required

Matches the response’s x-request-id header.

string
Cache-Control
string

No-store

x-request-id
string

Always present. A fresh server-generated UUID for this request; incoming IDs are ignored. On errors, this equals the response body’s request_id.

413: the request body exceeds the configured size limit.

Media typeapplication/json

The common JSON body for errors returned by the HTTP application.

object
code
required

Stable machine-readable error code.

string
details
One of:
null
message
required

Safe explanation without internal errors or submitted input values.

string
request_id
required

Matches the response’s x-request-id header.

string
Cache-Control
string

No-store

x-request-id
string

Always present. A fresh server-generated UUID for this request; incoming IDs are ignored. On errors, this equals the response body’s request_id.

Request fields, manifest, installation policy, or limits are invalid.

Media typeapplication/json

The common JSON body for errors returned by the HTTP application.

object
code
required

Stable machine-readable error code.

string
details
One of:
null
message
required

Safe explanation without internal errors or submitted input values.

string
request_id
required

Matches the response’s x-request-id header.

string
Cache-Control
string

No-store

x-request-id
string

Always present. A fresh server-generated UUID for this request; incoming IDs are ignored. On errors, this equals the response body’s request_id.

Authentication, identity provider, or management state is temporarily unavailable.

Media typeapplication/json

The common JSON body for errors returned by the HTTP application.

object
code
required

Stable machine-readable error code.

string
details
One of:
null
message
required

Safe explanation without internal errors or submitted input values.

string
request_id
required

Matches the response’s x-request-id header.

string
Cache-Control
string

No-store

x-request-id
string

Always present. A fresh server-generated UUID for this request; incoming IDs are ignored. On errors, this equals the response body’s request_id.

An HTTP request failed; inspect the stable error code and request ID.

Media typeapplication/json

The common JSON body for errors returned by the HTTP application.

object
code
required

Stable machine-readable error code.

string
details
One of:
null
message
required

Safe explanation without internal errors or submitted input values.

string
request_id
required

Matches the response’s x-request-id header.

string
Cache-Control
string

No-store

x-request-id
string

Always present. A fresh server-generated UUID for this request; incoming IDs are ignored. On errors, this equals the response body’s request_id.

Documentation 205dcb3116ea · public sources 8c70356d340f · built .Download documentation identity.