---
title: "Get a token"
method: GET
path: "/v1/tokens/{token}"
tags: ["Tokens"]
---

# Get a token

`GET /v1/tokens/{token}`

## Request

- Base URL: `https://api.subscriby.net`
- URL: `https://api.subscriby.net/v1/tokens/{token}`
- Auth: HTTP bearer

```bash
curl https://api.subscriby.net/v1/tokens/$TOKEN_ID \
  -H "Authorization: Bearer $SUBSCRIBY_TOKEN"
```

One of the caller's tokens, without its value.

- `id` is an **integer** serialised as a string, the one identifier in the platform that is not a UUID. See [Identifiers](https://docs.subscriby.net/api/v1#identifiers).
- `abilities` is the gate strings only. Scope tuples (`scope:team:…`, `scope:project:…`) are split out into `scopes` for readability, so `abilities_count` counts real permissions rather than bookkeeping.
- The plaintext value is **never** returned here. Lose it and the only recovery is to revoke the token and mint another.

## Path parameters

- `token` integer, required

## Response `200`

The token resource.

- object
  - `data` TokenResource, required: One of the caller's personal access tokens, without its value. The plaintext exists exactly once, in the response that minted it.
    - `id` string, required: The token's id: an **integer** serialised as a string, the one identifier in the platform that is not a UUID.
    - `name` string, required: The label the token was minted with.
    - `abilities` string[], required: The gate abilities only; the scope tuples are split out into `scopes`.
    - `scopes` object, required: The token's confinement, read out of its `scope:team:` and `scope:project:` abilities as structure rather than opaque strings.
      - `team_id` string, required: The team the token is scoped to; null for a token minted without a team scope.
      - `project_ids` string[], required: The projects the token is confined to; empty when it reaches every project of the team.
    - `abilities_count` integer, required: How many gate abilities the token holds, bookkeeping excluded.
    - `last_used_at` string, nullable, required: When the token last authenticated a request, ISO 8601; null until it has.
    - `expires_at` string, nullable, required: When the token stops working, ISO 8601; null for a token that does not expire.
    - `created_at` string, nullable, required: When the token was minted, ISO 8601.

## Other responses

- `401`: `AUTHENTICATION_REQUIRED`: the request carries no bearer token, or one that is revoked, malformed, or minted for another environment (an `sbt_test_` token on production).
- `403`: `TOKEN_MISSING_ABILITY`: the token is valid but does not carry the ability this endpoint requires; `error.context.required_ability` names the one to grant. An endpoint that also checks who owns a row or which tier the account is on answers `FORBIDDEN`, `TEAM_TIER_REQUIRED` or `CONNECTOR_TIER_REQUIRED` with the same status, and says so in its own description.
- `404`: `RESOURCE_NOT_FOUND`: an id in the path names nothing the token can see. `TENANT_MISMATCH`: the project sits outside the token's `scope:project:` allow-list, or the token carries no team scope. Both answer 404 rather than 403 so that existence outside the token's scope cannot be inferred.
- `429`: `RATE_LIMITED`: the token has spent its 300 requests a minute or 10,000 an hour; `Retry-After` says when the next one is accepted.

---

[API](https://skmtc.dev/memberpass/apis/subscriby-rest-api.md) · [All operations](https://skmtc.dev/memberpass/apis/subscriby-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/memberpass/apis/subscriby-rest-api/revisions/59c4df91d764?raw)