---
title: "List Authorization Tokens"
method: GET
path: "/v1/donor_accounts/{id}/authorization_tokens"
tags: ["Authorization Tokens"]
---

# List Authorization Tokens

`GET /v1/donor_accounts/{id}/authorization_tokens`

## Request

- Base URL: `https://sandboxapi.givechariot.com`
- URL: `https://sandboxapi.givechariot.com/v1/donor_accounts/{id}/authorization_tokens`
- Auth: HTTP bearer

List Authorization Tokens for a Donor Account.
Token codes are never returned by this endpoint — only the metadata is returned.

## Path parameters

- `id` string, required

## Query parameters

- `status` 'pending' | 'verified' | 'revoked' | 'expired': The status of a [Donor Authorization Token](/api/authorization-tokens). * `pending`: The token has been issued but not yet verified. * `verified`: The token has been verified and can no longer be used. * `revoked`: The token was explicitly revoked before being verified. * `expired`: The token's `expires_at` has passed and it can no longer be verified.
- `page_limit` integer
- `page_token` string

## Response `200`

The response for DonorAccounts.listAuthorizationTokens

- object
  - `results` DonorAuthorizationToken[]
    - `id` string, required: The unique identifier for this object.
    - `donor_account_id` string, required: The ID of the [Donor Account](/api/donor-accounts) this token is bound to.
    - `status` 'pending' | 'verified' | 'revoked' | 'expired', required: The status of a [Donor Authorization Token](/api/authorization-tokens). * `pending`: The token has been issued but not yet verified. * `verified`: The token has been verified and can no longer be used. * `revoked`: The token was explicitly revoked before being verified. * `expired`: The token's `expires_at` has passed and it can no longer be verified.
    - `code` string: The token's secret code value. <Warning> The `code` is **only returned in the response of [Create Authorization Token](/api/authorization-tokens/create)**. It is omitted from all other responses (Get, List). If the code is lost, [revoke](/api/authorization-tokens/revoke) the token and create a new one. </Warning> The format is a 12-character alphanumeric string designed to be easy for donors to read aloud or copy. Codes are not case-sensitive when verified.
    - `created_at` string, date-time, required: Time when the token was issued. Expressed in RFC 3339 format.
    - `expires_at` string, date-time, required: Time at which this token will expire and can no longer be verified. Defaults to 30 days after creation; configurable via the `expires_in` parameter on [Create Authorization Token](/api/authorization-tokens/create).
    - `verified_at` string, date-time: Time at which the token was verified. Only set when `status` is `verified`.
    - `revoked_at` string, date-time: Time at which the token was revoked. Only set when `status` is `revoked`.
    - `metadata` object: A map of arbitrary string keys and values to store information about the object.
  - `next_page_token` string, nullable: A cursor token to use to retrieve the next page of results by making another API call to the same endpoint with the same parameters (only changing the page_token). If specified, then more results exist on the server that were not returned, otherwise no more results exist on the server.

## Other responses

- `400`: The request is invalid or contains invalid parameters
- `401`: Unauthorized. The request is missing the security (OAuth2 Bearer token) requirements and the server is unable to verify the identify of the caller.
- `403`: Access denied
- `404`: Resource Not Found
- `500`: Internal Server Error

---

[API](https://skmtc.dev/chariot-giving/apis/chariot-api-5.md) - [All operations](https://skmtc.dev/chariot-giving/apis/chariot-api-5/llms.txt) - [OpenAPI document](https://skmtc.dev/chariot-giving/apis/chariot-api-5/revisions/d2a4ff2fdda5?raw)