---
title: "Token detail"
method: GET
path: "/v2/storage/branch/{branchId}/tokens/{id}"
tags: ["Tokens and Permissions"]
---

# Token detail

`GET /v2/storage/branch/{branchId}/tokens/{id}`

## Request

- Base URL: `https://connection.keboola.com`
- URL: `https://connection.keboola.com/v2/storage/branch/{branchId}/tokens/{id}`
- Auth: one of:
  - API key in header `X-StorageApi-Token`
  - API key in header `X-KBC-ManageApiToken`
  - HTTP bearer
- TypeScript: <https://skmtc.dev/keboola/apis/keboola-storage-api/docs/v2/storage/branch/:branchId/tokens/:id/get.ts> (a function with typed inputs; its response is checked against the schema)

Returns all properties of a token, including the project it belongs to (`owner`). You can obtain the token ID, for example, using the Token verification call.

Requesting the token used for authorization is always allowed; requesting any other token requires the `canManageTokens` permission.

Available both with and without a development branch prefix; the returned token properties and permission rules are the same in either case.

## Path parameters

- `id` integer, required
- `branchId` string, required

## Response `200`

Token detail response.

- TokenVerifyResponse
  - `id` string, required: Unique identifier of the token.
  - `created` string, nullable, required: Token creation timestamp, ISO 8601 with a `+hhmm` offset.
  - `refreshed` string, nullable, required: Token last refresh timestamp, ISO 8601 with a `+hhmm` offset.
  - `description` string, required: User-provided description of the token.
  - `uri` string, required: URI of the token detail.
  - `isMasterToken` boolean, required: Whether this is a master (admin) token.
  - `canManageBuckets` boolean, required: Token permission to manage all buckets.
  - `canManageTokens` boolean, required: Token permission to manage tokens.
  - `canReadAllFileUploads` boolean, required: Token permission to read all file uploads.
  - `canPurgeTrash` boolean, required: Token permission to permanently remove deleted configurations.
  - `canManageProtectedDefaultBranch` boolean, required: Token permission to manage the protected default branch.
  - `canCreateJobs` boolean, required: Token permission to create jobs.
  - `canReadAllProjectEvents` boolean, required: Token permission to read all project events.
  - `canManageDevBranches` boolean, required: Token permission to manage development branches.
  - `expires` string, nullable, required: Expiration timestamp of the token, ISO 8601 with a `+hhmm` offset; null when the token never expires.
  - `isExpired` boolean, required: Whether the token is expired.
  - `isDisabled` boolean, required: Whether the token is disabled.
  - `dailyCapacity` integer, required: Daily capacity of the token.
  - `token` string: Decrypted token value. Present only when the project has a dedicated project feature enabled, the default branch is not protected and the token cannot manage the protected default branch.
  - `creatorToken` object: Token that created this token. Present only when the token was created by another token.
    - `id` integer, required: ID of the creator token.
    - `description` string, required: Description of the creator token.
  - `actor` ActorResponse, required: Who performed the action and through which credential.
    - `type` 'token' | 'session' | 'pat' | 'system', required: Credential the action came through: a Storage token, a programmatic session, a personal access token, or system work.
    - `id` string, required: Token id as a string, session or personal access token UUID, or the system subject.
    - `name` string, required: Token description, the admin email for a session or personal access token, or the system label, as it was when the action happened.
    - `adminId` integer, nullable, required: Admin behind the credential; null for a token without an admin, for system work, and when the admin was not recorded (an object whose creator is known only from its token columns, including rows backfilled from them).
  - `componentAccess` string[]: Component IDs the token may access. Present only when at least one component is granted.
  - `bucketPermissions` object, required: Bucket permissions keyed by bucket ID (`read`, `write` or `manage`).
  - `owner` object, required: Project the token belongs to.
    - `id` integer, required
    - `name` string, required
    - `type` string, required
    - `region` string, required
    - `created` string, nullable, required: ISO 8601 with a `+hhmm` offset.
    - `expires` string, nullable, required: ISO 8601 with a `+hhmm` offset.
    - `features` string[], required
    - `dataSizeBytes` integer, required
    - `rowsCount` integer, required
    - `hasMysql` boolean, required: Always false.
    - `hasSynapse` boolean, required
    - `hasSnowflake` boolean, required
    - `hasExasol` boolean, required
    - `hasTeradata` boolean, required
    - `hasBigquery` boolean, required
    - `defaultBackend` string, required
    - `hasTryModeOn` string, required
    - `limits` object, required: Project limits keyed by limit name.
    - `metrics` object, required: Project metrics keyed by metric name.
    - `isDisabled` boolean, required
    - `billedMonthlyPrice` integer, nullable, required
    - `dataRetentionTimeInDays` integer, required
    - `assignedBackends` string[], required
    - `timezone` string, nullable, required: Project timezone; used by BigQuery projects only.
    - `isBYODB` boolean, required
    - `usersCount` integer, required
    - `fileStorageProvider` string: Present only when a file storage is assigned.
    - `payAsYouGo` object: Present only for projects with the `pay-as-you-go` feature.
      - `purchasedCredits` number, required
    - `disabled` object: Present only when the project is disabled.
      - `reason` string, required
      - `estimatedEndTime` string, nullable, required: ISO 8601 with a `+hhmm` offset.
  - `isBYODB` boolean, required: Whether the project uses a Bring Your Own Database backend. Kept for backward compatibility, same as `owner.isBYODB`.
  - `organization` object, required
    - `id` string, nullable, required: ID of the organization the project belongs to, as a numeric string.
    - `created` string, date-time, nullable, required: Creation time of the organization. Null when the creation time is unavailable.
  - `admin` object: Administrator the token belongs to. Present only when the token belongs to an administrator.
    - `name` string, required
    - `id` integer, required
    - `features` string[], required
    - `isOrganizationMember` boolean, required
    - `role` 'admin' | 'guest' | 'readOnly' | 'share' | 'developer' | 'reviewer' | 'productionManager', nullable, required: Null when the project membership has no role stored.
    - `isActivated` boolean, required
    - `samlParameters` union: Raw SAML attribute statement asserted by the IdP on last login, keyed by IdP-defined attribute name (e.g. a role or group claim); attribute names and count vary per IdP configuration. Present only when SAML is enabled on the stack; an empty array `[]` when no attributes are stored.
      - object
      - unknown[]
        - unknown
  - `adminOwner` object: Administrator who owns the token. Present only when an owner can be resolved.
    - `id` integer, required
    - `name` string, required
    - `email` string, required

## Other responses

- `403`: The authorizing token may not read other tokens (`accessDenied`).
- `404`: Token not found (`storage.tokens.notFound`).

---

[API](https://skmtc.dev/keboola/apis/keboola-storage-api.md) - [All operations](https://skmtc.dev/keboola/apis/keboola-storage-api/llms.txt) - [OpenAPI document](https://skmtc.dev/keboola/apis/keboola-storage-api/revisions/34b5ceac0317?raw)