List API tokens

GET

/orgs/{org}/tokens

curl --request GET \
  --url https://api.sloose.com/orgs/org_9f3c/tokens \
  --header 'Authorization: Bearer <token>'

• Production

Every token the organisation has issued, revoked ones included, with its prefix, creator, last use, expiry and revocation. Never the secret — the server keeps only a hash, so a lost token is replaced, not recovered.

Authorizations

• sessionAuth
• apiTokenAuth

Parameters

Path Parameters

org

required

The organisation id the session was issued for. A token for one organisation can never read another.

string

Example

org_9f3c

The organisation id the session was issued for. A token for one organisation can never read another.

Responses

200

Every token, revoked ones included.

Media typeapplication/json

object

tokens

required

Array<object>

Never includes the secret — the server keeps only a hash of it.

object

id

required

string

orgId

required

string

name

required

string

prefix

required

The token’s leading characters, for recognising it in a list.

string

role

required

string

createdByUserId

required

string

createdByEmail

required

The address of the member who minted it. A token acts as them.

string

lastUsedAt

required

string | null

expiresAt

required

string | null

revokedAt

required

string | null

createdAt

required

string

Example^generated

{
  "tokens": [
    {
      "id": "example",
      "orgId": "example",
      "name": "example",
      "prefix": "example",
      "role": "example",
      "createdByUserId": "example",
      "createdByEmail": "example",
      "lastUsedAt": "example",
      "expiresAt": "example",
      "revokedAt": "example",
      "createdAt": "example"
    }
  ]
}

401

No bearer, or one that no longer resolves: a session that is unknown or expired (code: AUTH_REQUIRED), or an API token that was revoked or expired (TOKEN_REVOKED, TOKEN_EXPIRED), whose organisation is gone (ORG_NOT_FOUND) or whose member or user row is (MEMBERSHIP_GONE).

Media typeapplication/json

The error envelope every non-2xx answer uses.

object

error

required

Human-readable explanation.

string

code

Machine-readable reason. Absent on a few legacy 400s.

string

key

additional properties

Example^generated

{
  "error": "example",
  "code": "example"
}

403

The bearer’s role is too low (code: ROLE_REQUIRED), or it was issued for a different organisation; the organisation has been closed (code: ORG_CLOSED, either kind of bearer); the person is banned (code: BANNED, a session); or it is a session that is signed in but in no organisation (code: NO_ORG): one that never joined one, or whose person was taken out of the one it was in, or left it. Signing in again changes nothing for NO_ORG; choosing or making an organisation does.

Media typeapplication/json

The error envelope every non-2xx answer uses.

object

error

required

Human-readable explanation.

string

code

Machine-readable reason. Absent on a few legacy 400s.

string

key

additional properties

Example^generated

{
  "error": "example",
  "code": "example"
}

503

The restore switch is on (code: MAINTENANCE): every route but /health and /robots.txt is refused before anything is read, except the operator’s own POST /staff/people/{id}/delete with the ADMIN_TOKEN. Sloose is down for maintenance. Please try again in a few minutes.

Media typeapplication/json

object

error

required

string

code

required

string

Allowed value: MAINTENANCE

Example

{
  "code": "MAINTENANCE"
}

Headers

Retry-After

integer

Seconds until asking again is worth it (300 while the switch is on).