---
title: "List API tokens and their state, never their secrets"
method: GET
path: "/v1/tokens"
tags: ["admin"]
---

# List API tokens and their state, never their secrets

`GET /v1/tokens`

## Request

- Base URL: `https://api.indraft.io`
- URL: `https://api.indraft.io/v1/tokens`
- Auth: HTTP bearer

Every token, its label, the scopes it asked for, who created it and when it was last used. Secrets are stored as hashes and are never returned, here or anywhere.

## Response `200`

Success

- object
  - `tokens` object[], required
    - `id` string, required
    - `prefix` string, required
    - `scopes` string[], required
    - `label` string, required
    - `lastUsedAt` string, required
    - `revokedAt` string, required
    - `createdAt` string, required

## Other responses

- `401`: No credential, or one that has been revoked.
- `403`: Authenticated, and this capability is not held.
- `429`: Infrastructure protection tripped. This is not a product quota.
- `500`: A defect on our side. The hint says so, and carries an incident id.

---

[API](https://skmtc.dev/indraft/apis/indraft-api.md) · [All operations](https://skmtc.dev/indraft/apis/indraft-api/llms.txt) · [OpenAPI document](https://skmtc.dev/indraft/apis/indraft-api/revisions/d9bb05346d66?raw)