List the user's personal access tokens..

GET

/v1/iam/users/{userId}/tokens

Code sample: Shell / cURL

curl --request GET \
  --url https://stratum.example.com/v1/iam/users/example/tokens \
  --header 'Authorization: Bearer <token>'

• A Stratum cluster endpoint.

Returns metadata only — the plaintext token value is never recoverable after creation. Includes id + label + scopes + createdAt + lastUsedAt + expiresAt for every non-revoked PAT owned by userId.

Self-action: gated by iam:ListPersonalAccessToken (covered by every authenticated principal’s implicit self-permit). Admin-acting-on-someone-else: gated by iam:ListPersonalAccessTokenAdmin (covered by the blanket bootstrap-admin / platform-admin permits).

Authorizations

• bearerAuth

Parameters

Path Parameters

userId

required

string

/^u-[a-z0-9-]+$/

Responses

200

PAT metadata.

Media typeapplication/json

object

items

required

Array<object>

Personal Access Token. The token field is populated ONLY on the response to POST create — every other read returns metadata-only with token omitted.

object

id

required

string

/^tok-[a-z0-9]+$/

userId

required

string

/^u-[a-z0-9-]+$/

kind

required

string

Allowed values: pat

label

string

<= 100 characters

scopes

Array<string>

createdAt

required

string format: date-time

lastUsedAt

string format: date-time

nullable

expiresAt

string format: date-time

nullable

revokedAt

string format: date-time

nullable

token

The plaintext PAT value. Populated only on POST create. Show ONCE — the DB stores only sha256(token) so this is the only response that ever surfaces the secret. Treat with the same care as a session cookie.

string

>= 30 characters

nextPageToken

string

isTruncated

True when the server had more rows than it returned. The response is a valid prefix of the result, not the whole of it.

Without this flag a client at the server’s row ceiling receives a full page and no nextPageToken, which means “this is the complete set” — so data it never saw would be indistinguishable from data that does not exist.

It does not imply a cursor exists. These queries do not all sort on a total order, so a resumable token cannot be minted for them yet. The remedy is to narrow the request (a filter, or a tighter scope), not to page.

boolean

Example

{
  "items": [
    {
      "kind": "pat"
    }
  ]
}

401

Missing or invalid token.

Media typeapplication/problem+json

object

type

required

string format: uri

title

required

string

status

required

integer

>= 400 <= 599

detail

string

instance

string format: uri-reference

requestId

required

string

code

required

string

issues

The findings of a rejected IAM policy document (custom and resource policies).

Array<object>

One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.

object

code

required

The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.

string

statement

required

Index of the statement at fault; -1 for the document as a whole.

integer

>= -1

detail

required

string

action

The offending action, where one is at fault (ACTION_NOT_APPLICABLE).

string

errors

Field errors, for codes that carry them: each problem at its field (see FieldError). Documented on the responses that set it, e.g. approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED. Absent otherwise.

Array<object>

One field’s problem, the stage-2 installer API’s shape. field is the field’s path, message what is wrong with it.

object

field

required

The field’s path, e.g. links[0].interface, disks[1].confirm, mgmt.address or role; empty for the whole request.

string

message

required

string

details

Structured facts about the refusal, for codes that carry them. The shape is fixed per code and documented on the response that answers it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and IMAGE_IN_USE. Absent for codes that carry none.

object

key

additional properties

any

Example

{
  "issues": [
    {
      "code": "ACTION_NOT_APPLICABLE",
      "action": "compute:CreateVpc"
    }
  ]
}

Headers

WWW-Authenticate

string

403

Authenticated but not authorized.

Media typeapplication/problem+json

object

type

required

string format: uri

title

required

string

status

required

integer

>= 400 <= 599

detail

string

instance

string format: uri-reference

requestId

required

string

code

required

string

issues

The findings of a rejected IAM policy document (custom and resource policies).

Array<object>

One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.

object

code

required

The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.

string

statement

required

Index of the statement at fault; -1 for the document as a whole.

integer

>= -1

detail

required

string

action

The offending action, where one is at fault (ACTION_NOT_APPLICABLE).

string

errors

Field errors, for codes that carry them: each problem at its field (see FieldError). Documented on the responses that set it, e.g. approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED. Absent otherwise.

Array<object>

One field’s problem, the stage-2 installer API’s shape. field is the field’s path, message what is wrong with it.

object

field

required

The field’s path, e.g. links[0].interface, disks[1].confirm, mgmt.address or role; empty for the whole request.

string

message

required

string

details

Structured facts about the refusal, for codes that carry them. The shape is fixed per code and documented on the response that answers it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and IMAGE_IN_USE. Absent for codes that carry none.

object

key

additional properties

any

Example

{
  "issues": [
    {
      "code": "ACTION_NOT_APPLICABLE",
      "action": "compute:CreateVpc"
    }
  ]
}