List current user's API tokens
Returns all personal access tokens for the authenticated user, ordered by creation date (newest first). Admins can pass user_id to list another user's tokens. Token digests are never exposed. Session auth only — token-authenticated requests receive 403.
Parameters
Query Parameters
Admin-only. List tokens for this user instead of the current user.
42Responses
Token list
Create a new API token
Creates a personal access token ON THE SIGNED-IN ACCOUNT. The raw token is returned ONCE in the response — it is never stored or retrievable after this. Requires current password for session hijack protection. Session auth only. Max 20 active tokens per user, max 365-day lifetime. Ownership can never be redirected: a token authenticates AS its owner, so no caller — administrators included — may mint one on another user's account, and any user_id supplied in the body is ignored. Administrators oversee other users' tokens by listing (GET with user_id) and revoking them; account recovery goes through a password reset, where the user re-authenticates.
Request Body
Responses
Token created — raw token shown once
Revoke an API token
Soft-deletes the token by setting revoked_at. The token immediately stops working for API authentication. Audit trail is preserved. Session auth only — users can only revoke their own tokens.
Responses
Token revoked
Admin revoke any user's token
Admin-only endpoint. Revokes any user's token with a required audit comment explaining the reason (e.g. compromised credentials). The audit comment is recorded in the audit trail. Session auth only.
Request Body
Responses
Token revoked by admin