---
title: "List an end user's minted tokens"
method: GET
path: "/credits/end-users/{externalUserId}/tokens"
tags: ["End users"]
---

# List an end user's minted tokens

`GET /credits/end-users/{externalUserId}/tokens`

## Request

- Base URL: `https://api.paywithlocus.com/api`
- URL: `https://api.paywithlocus.com/api/credits/end-users/{externalUserId}/tokens`
- Auth: one of:
  - HTTP bearer
  - HTTP bearer

Token metadata for one end user, newest first, capped at 200 records. Use it to audit what is outstanding and to find the tokenId to revoke. The tokens themselves are returned only at mint time and are never recoverable.

## Path parameters

- `externalUserId` string, required: Case-sensitive immutable ID in the tenant namespace. Prefer an identity-provider subject, not an email address.

## Response `200`

Token metadata

- object
  - `success` unknown, required
  - `tokens` EndUserTokenRecord[], required
    - `id` string, uuid, required
    - `signingKeyId` string, required: kid of the RS256 key that signed it, resolvable through the public JWKS.
    - `status` 'active' | 'expired' | 'revoked', required: Reported as expired as soon as expiresAt has passed, without waiting for a sweep.
    - `expiresAt` string, date-time, required
    - `revokedAt` string, date-time, nullable, required
    - `revokedReason` string, nullable, required
    - `lastUsedAt` string, date-time, nullable, required
    - `createdAt` string, date-time, required

## Other responses

- `403`: The authenticated management credential lacks one or more required scopes

---

[API](https://skmtc.dev/paywithlocus/apis/locus-pro-api.md) - [All operations](https://skmtc.dev/paywithlocus/apis/locus-pro-api/llms.txt) - [OpenAPI document](https://skmtc.dev/paywithlocus/apis/locus-pro-api/revisions/aab8fa5d6cef?raw)