Access Tokens

Retrieves the access tokens created for an organization. Organization tokens provide CI/CD automation access scoped to the organization rather than tied to individual user accounts. The response includes token metadata such as name, description, creation date, last used date, and expiration status. The actual token values are never returned after initial creation. Use the filter query parameter to narrow by status (active, expired, all). Use the search query parameter to match token name, description, ID, or creator login. Results are paginated; use continuationToken (returned in the response) and maxResults to page.

Request Parameters

• orgName string path required
  The organization name
• continuationToken string query optional
  Opaque token for fetching the next page of results.
• filter string query optional
  Filter tokens by status (active, expired, or all). Defaults to active.
• maxResults integer query optional
  Maximum number of tokens per page. Defaults to 100, maximum 1000.
• search string query optional
  Case-insensitive substring match on token name, description, ID, or creator login

Responses

Generates a new access token scoped to the organization for use in CI/CD pipelines and automated workflows. Organization tokens belong to the organization rather than individual users, ensuring that access is not disrupted when team members leave.

The name field must be unique across the organization (including deleted tokens) and cannot exceed 40 characters. The expires field accepts a unix epoch timestamp up to two years from the present, or 0 for no expiry (default).

Important: The token value in the response is only returned once at creation time and cannot be retrieved later. Audit logs for actions performed with organization tokens are attributed to the organization rather than an individual user.

Request Parameters

• orgName string path required
  The organization name
• reason string query optional
  Audit log reason for creating this token

Request Body

Responses

Permanently revokes and deletes an organization access token. Any CI/CD pipelines or automation using this token will immediately lose access to the organization’s resources. This action cannot be undone.

Request Parameters

• orgName string path required
  The organization name
• tokenId string path required
  The access token identifier

Responses

Returns the access tokens currently bound to the authenticated user: personal access tokens (Bearer-usable) and refresh tokens issued during agent signup (exchange-only at POST /api/oauth/token; 401 if presented as Bearer). Web-session tokens are excluded. Use the filter query parameter to narrow by status (active, expired, all). Use the search query parameter to match token name or description, or to prefix-match token ID. Results are paginated; use continuationToken (returned in the response) and maxResults to page. Revoke any entry via DELETE /api/user/tokens/{tokenId}, which is type-agnostic.

Request Parameters

• continuationToken string query optional
  Opaque token for fetching the next page of results.
• filter string query optional
  Filter tokens by status (active, expired, or all). Defaults to active.
• maxResults integer query optional
  Maximum number of tokens per page. Defaults to 100, maximum 1000.
• search string query optional
  Case-insensitive substring match on token name or description, or prefix match on token ID

Responses

Creates a new personal access token for the authenticated user. The request body includes a description for the token and an optional expiration time. The response includes the token ID and the tokenValue (prefixed with ‘pul-’). The token value is only returned once at creation time and cannot be retrieved later.

Request Parameters

• reason string query optional
  Tracks the context that triggered token creation (e.g., redirect URL or referral source)

Request Body

Responses

Permanently deletes a personal access token by its identifier. The token is immediately invalidated and can no longer be used for authentication. Returns 204 on success or 404 if the token does not exist.

Request Parameters

• tokenId string path required
  The access token identifier

Responses