listPersonalAccessTokens

GET

/api/v1/me/security/pats

const url = 'https://example.com/api/v1/me/security/pats';
const options = {method: 'GET', headers: {cookie: 'tilecast_session=<tilecast_session>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url https://example.com/api/v1/me/security/pats \
  --cookie tilecast_session=<tilecast_session>

Requires an authenticated user with the admin scope. Lists the caller’s personal access tokens newest first with display metadata only — never secrets. Expired and revoked tokens stay listed until explicitly revoked. An optional search query filters by name, case-insensitively.

Authorizations

sessionCookie
userBearer

Parameters

Query Parameters

search

string

Responses

200

PAT list

application/json

object

data

required

object

pats

required

Array<object>

object

required

string format: uuid

name

required

string

scopes

required

Array<string>

Allowed values: read write admin

createdAt

required

string format: date-time

expiresAt

required

string format: date-time

lastUsedAt

required

string | null format: date-time

revokedAt

required

string | null format: date-time

Example

{
  "data": {
    "pats": [
      {
        "scopes": [
          "read"
        ]
      }
    ]
  }
}

401

Dashboard authentication required