List your CLI tokens (metadata only)

GET

/v1/tokens

const url = 'https://beta-api.plune.ai/v1/tokens';
const options = {method: 'GET', headers: {cookie: 'plune_session=<plune_session>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url https://beta-api.plune.ai/v1/tokens \
  --cookie plune_session=<plune_session>

The same screen (api.ts → listTokens): prefix, dates and expiry of every token, never the plaintext — that was shown once at minting. limit beside the list is the ceiling POST /v1/tokens enforces, so the screen can say “N of M” before the click.

Authorizations

cookieAuth

Responses

200

Your tokens

application/json

object

tokens

required

Array<object>

object

required

string format: uuid

scope

required

What a token may do (#1283). read answers GET, HEAD and OPTIONS (and POST /v1/test-cases/resolve, which only reads) and refuses every other request with 403 read-only token, each refusal written to the audit log as an api_token entry of action event (the token, the method and the path). write is everything its owner may do, and is what every token issued before this existed holds. Whatever its scope, a token that names a session in X-Plune-Session (an agent) is refused every DELETE with 403 agent_cannot_delete (#1280): a deletion is confirmed by a person. A token without the header, and a person with a session cookie, are not held.

string

Allowed values: read write

prefix

required

string

createdAt

required

string format: date-time

revokedAt

required

string format: date-time

nullable

expiresAt

When the token stops working on its own. null for tokens issued before expiry existed (#258); new ones get 90 days.

string format: date-time

nullable

projectId

required

The project it writes to. null — every token from before B8-team — means the owner’s default project.

string

nullable

limit

required

How many live tokens one account may hold; the mint answers 409 past it. Here so a screen can say “N of M” before the click rather than after.

integer

Example

{
  "tokens": [
    {
      "scope": "read"
    }
  ]
}

401

No / invalid session