Skip to content
GitmoapAPIBeta
Organizeaccess-tokens
GET/user/tokens

List the authenticated user's personal access tokens

list_personal_tokens
  • token:read
    A token needs the token:read scope: View access tokensGranted by read_api, write_api.Every operation this scope unlocks
  • Audited · sensitive read

    x-gitmoap-audit: {"kind":"audited","arg":"sensitive_read"}

  • Single-resource

    x-gitmoap-isolation: {"kind":"single_or_self_scoped"}

  • Paginated
    Pass the next_token a page returns to get the next one.

Your own tokens, newest first: each one's name, scopes, any group or repository it is bound to, expiry and when it was last used, and the app that minted it when it came from connecting an app. The secret itself is never shown again. Each read is recorded in the audit log.

Parameters

Query
  • limitinteger · int32optionalPage size (1-100)
  • next_tokenstringoptionalPagination cursor

Responses

200Tokens listedapplication/json
  • itemsarray of AccessTokenView
    • The AccessTokenView schema
    • access_token_idAccessTokenId (string · uuid)
    • created_atstring
    • namestring
    • principal_idstring
    • principal_kindTokenPrincipalKinduserservice_accountagentThe kind of principal an access token authenticates as.
    • scopesarray of string
    • expires_atstring or nulloptional
    • last_used_atstring or nulloptional
    • oauthAccessTokenOAuth or nulloptionalPresent when an app connected through sign-in minted this token. Revoking it disconnects the app.
    • resource_scope_idstring or nulloptional
    • resource_scope_typeScopeTypegrouprepositoryor nulloptional
  • next_tokenstring or nulloptional
200 exampleSynthesized example
{
"items": [
{
"access_token_id": "4d2cbd4e-9a2d-47d8-a231-55f5eabd66a2",
"created_at": "2026-10-08T18:29:57Z",
"name": "payments-api",
"principal_id": "e2595562-2017-4681-a0c0-71b8b1d3e025",
"principal_kind": "user",
"scopes": []
}
],
"next_token": "next-token-d639"
}
401Unauthorizedapplication/json
Error codes
  • UNAUTHORIZEDNo credential was sent, or the one sent is invalid, expired or revoked
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
401 exampleSynthesized example
{
"error": {
"code": "code-dae7",
"message": "Stream pipeline status into the run header"
}
}
403Forbidden — the caller's access level or token scope is insufficientapplication/json
Error codes
  • FORBIDDENYou are signed in but may not do this here; reason names the permission or the rule that refused it
  • INSUFFICIENT_SCOPEThe access token lacks the scope this operation needs; required_scope names it
  • PERMISSION_REQUIREDYou need a permission you do not hold here; the message names it
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
403 exampleSynthesized example
{
"error": {
"code": "code-ad16",
"message": "Inline scalar newtypes but keep their brand"
}
}

CLI

gitmoap access-tokens list-personal-tokens

  • --limitnumberoptionalPage size (1-100)
  • --next-tokenstringoptionalPagination cursor

Used in these guides