REST API · projects

GET /projects/{slug}/tokens

List a project's tokens, any holder (needs an account management token with the `read` scope).

Metadata only — never a hash, never the plaintext.

get_api_project_tokens_list

Authentication

• Bearer

Parameters

Responses

200

The project's tokens.

application/json

{
    "tokens": [
        {
            "id": "a7b8c9d0-1e2f-4a7b-b28d-5e6f7a8b9c0d",
            "label": "CI pipeline",
            "scopes": [
                "read",
                "config"
            ],
            "createdAt": "2026-01-15T09:00:00+00:00",
            "lastUsedAt": "2026-01-15T09:05:00+00:00",
            "expiresAt": "2026-01-16T09:00:00+00:00",
            "revokedAt": null,
            "spendLimitEurCents": null
        }
    ],
    "count": 1
}

404

No project with this slug found on your account.

application/json

{
    "required": [
        "error"
    ],
    "properties": {
        "error": {
            "description": "Machine-readable error code, e.g. \"not_found\", \"forbidden\", \"validation\".",
            "type": "string",
            "enum": [
                "bad_request",
                "unauthorized",
                "insufficient_credits",
                "forbidden",
                "web_only",
                "allowlist_widens",
                "not_found",
                "conflict",
                "draft_revision_conflict",
                "rollback_confirmation_conflict",
                "not_replayable",
                "targets_outside_allowlist",
                "gone",
                "deprecated_operation",
                "validation",
                "rate_limited",
                "payment_provider",
                "verification_unavailable",
                "analytics_unavailable",
                "credential_vault_unavailable",
                "notification_grants_unavailable"
            ]
        },
        "message": {
            "description": "Human-readable explanation of what went wrong. Absent on a field-level validation failure, where `fields` carries the detail instead.",
            "type": "string"
        },
        "object": {
            "description": "The resource the error concerns, when there is one.",
            "required": [
                "type",
                "id"
            ],
            "properties": {
                "type": {
                    "type": "string"
                },
                "id": {
                    "type": "string"
                }
            },
            "type": "object"
        },
        "action": {
            "description": "What to do next, naming the call or the panel page that does it. Absent when there is no corrective step.",
            "type": "string"
        },
        "fields": {
            "description": "Present when `error` is \"validation\" — one message per rejected field, keyed by the field name.",
            "type": "object",
            "additionalProperties": {
                "type": "string"
            }
        },
        "retry_after": {
            "description": "An RFC 3339 timestamp, the moment the request may be retried. Not every `rate_limited` refusal carries one.",
            "type": "string",
            "format": "date-time"
        }
    },
    "type": "object"
}