---
title: "List caller personal API tokens"
method: GET
path: "/api/tokens"
tags: ["Tokens"]
---

# List caller personal API tokens

`GET /api/tokens`

## Request

- Base URL: `https://tre-app.com`
- URL: `https://tre-app.com/api/tokens`
- Auth: HTTP bearer

Personal tokens only (kind personal); OAuth access tokens belong to their grant and are listed under Connected apps instead. A workspace-bound caller sees only its own tokens bound to that same workspace; unbound and differently bound tokens are excluded. Each token carries its guidanceGrants — the non-revoked guidance write grants on it, active or expired, newest first (grantGuidanceWrite).

## Response `200`

Success

- TokensResponse
  - `tokens` ApiTokenWithGrants[], required
    - `id` string, uuid, required
    - `name` string, required
    - `prefix` string, required
    - `kind` 'personal' | 'oauth', required
    - `scope` 'read' | 'write' | 'admin', required
    - `workspaceId` string, uuid, nullable, required
    - `clientId` string, nullable, required
    - `grantId` string, uuid, nullable, required: OAuth grant id when kind is oauth; null for personal tokens.
    - `expiresAt` string, date-time, nullable, required
    - `lastUsedAt` string, date-time, nullable, required
    - `createdAt` string, date-time, required
    - `revokedAt` string, date-time, nullable, required
    - `guidanceGrants` object[], required: The token's guidance write grants that are not revoked — active or expired, newest first. A grant lets this token write the workspace guidance card until it expires or is revoked (Settings → API tokens → Allow guidance writes).
      - `id` string, uuid, required
      - `tokenId` string, uuid, required
      - `workspace` string, required
      - `grantedBy` object, required
        - `id` string, uuid, nullable, required
        - `name` string, nullable, required
      - `grantedAt` string, date-time, required
      - `expiresAt` string, date-time, required
      - `revokedAt` string, date-time, nullable, required
      - `status` 'active' | 'expired' | 'revoked', required

## Other responses

- `400`: Invalid request
- `401`: Unauthenticated
- `403`: Forbidden: insufficient role or token scope; scope denials name the held scope and the operation
- `404`: Not found
- `409`: Conflict
- `429`: Rate limited
- `500`: Internal server error
- `503`: Temporarily unavailable

---

[API](https://skmtc.dev/tre-app/apis/tre-rest-api.md) · [All operations](https://skmtc.dev/tre-app/apis/tre-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/tre-app/apis/tre-rest-api/revisions/26a7187a05fc?raw)