Tokens

List and revoke your own personal access tokens from the API.

/me/tokens is the one place a token touches credentials — and only its owner's own. It needs no scope: any valid token may call it.

Endpoint	Scope
`GET /me/tokens`	none
`DELETE /me/tokens/{id}`	none

It is self-only: you see and revoke the tokens you minted in this organization, never anyone else's. Tokens are created only in the portal, with re-authentication, so a leaked token can never renew or widen itself. See Personal access tokens.

The token object

Field	Type	Notes
`id`	string	Opaque id.
`name`	string
`prefix`	string	Masked form, e.g. `tf-pat_AbCdE...a91f`. The secret is never returned.
`scopes`	string[]	Fixed at mint.
`status`	string	`active` or `revoked`. An expired token stays `active` here — compare `expires_at` with the current time.
`created_at`	string
`expires_at`	string \| null	When the token expires. Tokens always expire.
`last_used_at`	string \| null
`created_by`	object	`{ "id", "email" }` — you.

List your tokens

GET /api/v1/mgmt/me/tokens

Paginated, newest first.

Query parameter	Notes
`status`	`active` or `revoked`. Any other value → `422 validation_failed`.

curl https://portal.<domain>/api/v1/mgmt/me/tokens \
  -H "Authorization: Bearer $TF_PAT"

import os
import uuid
import requests
from datetime import datetime, timedelta, timezone

headers = {"Authorization": f"Bearer {os.environ['TF_PAT']}"}
tokens = requests.get("https://portal.<domain>/api/v1/mgmt/me/tokens", headers=headers, timeout=30).json()["data"]

soon = datetime.now(timezone.utc) + timedelta(days=7)
for t in tokens:
    if t["status"] == "active" and t["expires_at"] and datetime.fromisoformat(t["expires_at"].replace("Z", "+00:00")) < soon:
        print(f"rotate soon: {t['name']} ({t['prefix']}) expires {t['expires_at']}")

{
  "data": [
    {
      "id": "d9e8f7a6-b5c4-4d3e-9f2a-1b0c9d8e7f6a",
      "name": "CI · payments-deploy",
      "prefix": "tf-pat_AbCdE...a91f",
      "scopes": ["projects:read", "keys:read", "keys:write", "catalog:read"],
      "status": "active",
      "created_at": "2026-03-20T09:00:00Z",
      "expires_at": "2027-03-20T09:00:00Z",
      "last_used_at": "2026-09-24T10:05:31Z",
      "created_by": { "id": "8e7d6c5b-4a39-4281-9f0e-1d2c3b4a5968", "email": "[email protected]" }
    }
  ],
  "has_more": false,
  "next_cursor": null
}

Revoke one of your tokens

DELETE /api/v1/mgmt/me/tokens/{id}

Revocation is immediate and permanent — the next call with that token fails with 401 token_revoked. You may revoke the token you are calling with, and revoking an already-revoked token succeeds again. Returns 204 No Content. A token id that is not yours returns 404.

Like every non-GET Management API call, this route requires Idempotency-Key: a missing header is 400 idempotency_key_required, and reusing a key for a different request is 409 idempotency_conflict — see Idempotency.

curl -X DELETE https://portal.<domain>/api/v1/mgmt/me/tokens/d9e8f7a6-b5c4-4d3e-9f2a-1b0c9d8e7f6a \
  -H "Authorization: Bearer $TF_PAT_NEW" \
  -H "Idempotency-Key: rotate-ci-token-2026-09"

resp = requests.delete(
    f"https://portal.<domain>/api/v1/mgmt/me/tokens/{old_token_id}",
    headers={"Authorization": f"Bearer {os.environ['TF_PAT_NEW']}", "Idempotency-Key": str(uuid.uuid4())},
    timeout=30,
)
resp.raise_for_status()

The revocation is recorded in the audit log as pat_revoke.