---
title: "Get OAuth tokens"
method: GET
path: "/oauth_token/list"
tags: ["OAuth Tokens"]
---

# Get OAuth tokens

`GET /oauth_token/list`

## Request

- Base URL: `https://api.treasuredata.com/v3`
- URL: `https://api.treasuredata.com/v3/oauth_token/list`
- Auth: HTTP td1
- TypeScript: <https://skmtc.dev/treasure/apis/treasure-data-api/docs/oauth_token/list/get.ts> (a function with typed inputs; its response is checked against the schema)

Retrieves the account's live OAuth tokens: those whose row is not revoked, including tokens whose access half has expired, because a `refreshable` one can be exchanged for a new access token until the row is revoked -- a refresh token never expires. Administrators only, authenticated by an apikey or a session; an OAuth bearer token is refused. Token and refresh token strings are never returned.

Requires the `eng-lc-oauth-token-management` launch control flag on the account.

The response is always paged. `sorted_by` accepts `created_at:asc` and `created_at:desc`; without it the page is ordered by `id` ascending.

A client that still holds a token revokes it itself at `POST /oauth/revoke` (RFC 7009), which needs no administrator.

## Query parameters

- `user_id` Id (unresolved $ref)
- `page[size]` integer
- `page[after]` string, base64
- `sorted_by` string

## Response `200`

OK

- object
  - `oauth_tokens` OauthToken[], required
    - `id` integer, required: unique identifier of the token
    - `client` union, required: the OAuth client the token was issued to. `null` for a token issued without a client
      - object, nullable
      - OauthTokenClient: Minimal information on the OAuth client a token was issued to
        - `id` integer, required: unique identifier of the client
        - `name` string, required: the name of the client
    - `created_at` string, date-time, required: when the token was issued
    - `expired` boolean, required: whether the access half has expired. An expired token is still listed, because a `refreshable` one can be exchanged for a new access token until the row is revoked -- a refresh token never expires
    - `expires_at` string, date-time, nullable, required: when the access half expires. `null` for a token that never expires
    - `refreshable` boolean, required: whether the token carries a refresh token
    - `scopes` string, required: the scopes granted to the token, space separated
    - `sub_user` boolean, required: whether the owner is a sub user
    - `user` union, required: the user the token was issued on behalf of. `null` when the user no longer resolves
      - object, nullable
      - OauthTokenUserReference: Minimal information on the user an OAuth token belongs to
        - `id` integer, required: unique identifier of the user
        - `email` string, required: the email of the user
        - `name` string, required: the display name of the user
  - `pagination` Pagination, required (unresolved $ref)

## Changes

- **2026-09-08** `e5f660d781e9`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/treasure/apis/treasure-data-api/changes/oauth_token/list/get.md)

---

[API](https://skmtc.dev/treasure/apis/treasure-data-api.md) - [All operations](https://skmtc.dev/treasure/apis/treasure-data-api/llms.txt) - [OpenAPI document](https://skmtc.dev/treasure/apis/treasure-data-api/revisions/961bbd0161ae?raw)