---
title: "List API Tokens"
method: GET
path: "/orgs/{org_slug}/api-tokens"
tags: ["api-tokens"]
---

# List API Tokens

`GET /orgs/{org_slug}/api-tokens`

List all API Tokens.

This endpoint consumes 10 units of your quota.

This endpoint requires the following org token scopes:
- api-tokens:list

## Path parameters

- `org_slug` string, required

## Query parameters

- `sort` 'created_at'
- `direction` 'asc' | 'desc'
- `per_page` integer
- `page` integer
- `token_values` 'include' | 'omit'

## Response `200`

The paginated array of API tokens for the organization, and related metadata.

- object
  - `tokens` object[], required
    - `committers` object[], required — List of committers associated with this API Token
      - `email` string — Email address of the committer
      - `provider` 'api' | 'azure' | 'bitbucket' | 'github' | 'gitlab' — The source control provider for the committer
      - `providerLoginName` string — Login name on the provider platform
      - `providerUserId` string — User ID on the provider platform
    - `created_by` string, uuid, nullable, required — ID of the Socket user who created the API Token
    - `created_at` string, date, required — Timestamp when the API Token was created
    - `group_uuid` string, uuid, required — The stable group UUID that remains constant across token rotations
    - `hash` string, nullable, required — SRI-format hash of the token (e.g., sha512-base64hash). Null for tokens created before hash column was added.
    - `id` string, required — The ID of the API Token
    - `last_used_at` string, date, required — Timestamp when the API Token was last used
    - `max_quota` integer, required — Maximum number of API calls allowed per month
    - `name` string, nullable, required — Name for the API Token
    - `scopes` string[], required — List of scopes granted to the API Token
    - `token` string, nullable, required — The token of the API Token (redacted or omitted)
    - `visibility` 'admin' | 'organization', required — The visibility of the API Token. Warning: this field is deprecated and will be removed in the future.
  - `nextPage` integer, nullable, required

## Other responses

- `401` — Unauthorized
- `403` — Insufficient max_quota for API method
- `404` — Resource not found
- `429` — Insufficient quota for API route

---

[API](https://skmtc.dev/socket-dev/apis/socket.md) · [All operations](https://skmtc.dev/socket-dev/apis/socket/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/socket-dev/socket/revisions/bf994b75d33f/schema)