---
title: "List Oauth Tokens"
method: GET
path: "/oauth-tokens"
tags: ["OauthTokens"]
---

# List Oauth Tokens

`GET /oauth-tokens`

## Request

- Base URL: `https://api.purplegrain.com/api/v1`
- URL: `https://api.purplegrain.com/api/v1/oauth-tokens`
- Auth: HTTP bearer

Active access tokens as metadata (never the token strings): your
web/mobile sessions, MCP (AI-agent) connections, and tokens minted by
api credentials you own. Pass owner_type=Organization&owner_id to list
an organization's api-key tokens instead (requires edit rights;
organizations can only own api-kind applications, so members' personal
sessions never appear there). Filter with kind and application_id.

## Query parameters

- `kind` 'web_or_mobile' | 'api' | 'mcp'
- `application_id` string
- `owner_type` 'Organization'
- `owner_id` string
- `page` integer
- `per_page` integer

## Response `200`

Active tokens, newest first.

- OauthTokensIndexResponseAttributes
  - `data` OauthTokenModelAttributes[]
    - `id` string
    - `type` string
    - `kind` 'web_or_mobile' | 'api' | 'mcp'
    - `name` string, nullable
    - `application_name` string
    - `application_uid` string
    - `scopes` string
    - `organization_id` string, uuid, nullable
    - `created_at` string, date-time
    - `expires_at` string, date-time, nullable
    - `current` boolean
    - `last_used_at` string, date-time, nullable: When an AI-assistant connection last made a request, to the minute; null until it has, and on sessions and api-key tokens.
    - `new_organization_access` 'none' | 'read' | 'role': An AI-assistant connection's access in a business the person joins later. `role` is read and write where the role allows it, read only elsewhere.
    - `grants` OauthTokenGrant[]: An AI-assistant connection's grants, one per business plus the person's own account (`organization_id` null). Empty on a session, an api-key token, or a connection made before grants existed, which acts on its scopes alone.
      - `organization_id` string, uuid, nullable: The business; null is the person's own account.
      - `access` 'none' | 'read' | 'write', required
  - `meta` PaginationMeta
    - `current_page` number
    - `next_page` number, nullable
    - `prev_page` number, nullable

## Other responses

- `401`: Unauthorized
- `403`: Forbidden

---

[API](https://skmtc.dev/purplegrain/apis/purple-grain-api.md) · [All operations](https://skmtc.dev/purplegrain/apis/purple-grain-api/llms.txt) · [OpenAPI document](https://skmtc.dev/purplegrain/apis/purple-grain-api/revisions/06540345bbbc?raw)