#PersonalTokens

---

#GET /orgs/{id}/personal-tokens

List the current user's personal tokens for an org

Org membership required. Session-authed (not token-auth) — personal tokens cannot list themselves. Returns metadata only — never the secret value. Scoped to the caller's own tokens in-handler (metadata.userId match), not by org role.

Auth: Bearer token required

Path parameters

Name	Type	Description
id	string	Organization ID or slug

Responses

Status	Description	Schema
200	OK	PersonalTokenList
401	Unauthorized	Error
403	Forbidden	Error

---

#POST /orgs/{id}/personal-tokens

Create a personal token

Org membership required. Session-authed (not token-auth) — a token cannot mint more tokens. The raw token is returned exactly once in the response and is never retrievable again.

Auth: Bearer token required

Path parameters

Name	Type	Description
id	string	Organization ID or slug

Request body (application/json)

Field	Type	Description
name	string	Token label (required)
expiresAt	string(date-time)	Optional ISO expiry

Responses

Status	Description	Schema
201	Created	PersonalTokenCreated
400	Bad Request	Error
401	Unauthorized	Error
403	Forbidden	Error

---

#DELETE /orgs/{id}/personal-tokens/{tokenId}

Revoke a personal token

Org membership required. Session-authed (not token-auth). A user can only revoke their own personal tokens for the org (metadata.userId match, in-handler).

Auth: Bearer token required

Path parameters

Name	Type	Description
id	string	Organization ID or slug
tokenId	string	Personal token ID

Responses

Status	Description	Schema
200	OK	object
401	Unauthorized	Error
403	Forbidden	Error
404	Not Found	Error

#Schemas

#Error

Field	Type	Description
error	string	(required)
code	string

#PersonalTokenCreated

Field	Type	Description
id	string	(required)
name	string | null	(required)
tokenPrefix	string | null	(required)
expiresAt	string | string | null	(required)
createdAt	string | string	(required)
token	string	(required)

#PersonalTokenList

Type: object[]