The organisation's tokens

GET

/api/tokens

const url = 'https://app.dycrypt.com/o/acme/api/tokens';
const options = {method: 'GET', headers: {cookie: 'JSESSIONID=<JSESSIONID>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url https://app.dycrypt.com/o/acme/api/tokens \
  --cookie JSESSIONID=<JSESSIONID>

Never includes a secret. Requires a signed-in organisation administrator.

Authorizations

session

Responses

200

The tokens.

application/json

Array<object>

Never carries its secret. Only the call that mints one returns that, once.

object

integer format: int64

tokenId

The public half of the credential — the <id> in dyc_<id>_<secret>.

string

name

string

scopes

Array<string>

Allowed values: licenses:read licenses:write products:read products:write customers:read customers:write users:read users:write analytics:read activity:read

status

string

Allowed values: ACTIVE EXPIRED REVOKED

expiresAt

string | null format: date-time

lastUsedAt

Stamped at most once a minute, so a dead integration is visible without turning every read into a write.

string | null format: date-time

revokedAt

string | null format: date-time

createdAt

string format: date-time

createdBy

string

Example

[
  {
    "scopes": [
      "licenses:read"
    ],
    "status": "ACTIVE"
  }
]

401

No credential, or one that no longer resolves — revoked, expired, deleted. Replace it.

application/json

Every failure in this API has this shape and no other.

object

error

required

string

Example

{
  "error": "this token does not have licenses:write"
}

403

Not available to API tokens, or the caller is not an organisation administrator.

application/json

Every failure in this API has this shape and no other.

object

error

required

string

Example

{
  "error": "this token does not have licenses:write"
}