## List server tokens

`GET /v1/infra/servers/:id/access-tokens`

Returns the server's tokens filtered by status. By default, only active tokens are returned.

## Parameters

| Parameter | In | Type | Required | Description |
|----------|---|-----|:-----:|----------|
| `id` | path | string (UUID) | yes | BLACKHOLE server ID |
| `status` | query | string | no | Filter: `active` (default) \| `expired` \| `revoked` \| `all` |

## Examples

### curl — personal key

```bash
curl -H "X-Api-Key: YOUR_API_KEY" \
  "https://vibecode.bitrix24.com/v1/infra/servers/SERVER_ID/access-tokens?status=active"
```

### curl — OAuth application

```bash
curl -H "X-Api-Key: YOUR_APP_KEY" \
  -H "Authorization: Bearer USER_SESSION_TOKEN" \
  "https://vibecode.bitrix24.com/v1/infra/servers/SERVER_ID/access-tokens?status=all"
```

### JavaScript — personal key

```javascript
const res = await fetch(
  `https://vibecode.bitrix24.com/v1/infra/servers/${serverId}/access-tokens?status=active`,
  { headers: { 'X-Api-Key': 'YOUR_API_KEY' } }
)
const { data } = await res.json()
console.log(`Active tokens: ${data.tokens.length} / ${data.limits.activeCountMax}`)
```

### JavaScript — OAuth application

```javascript
const res = await fetch(
  `https://vibecode.bitrix24.com/v1/infra/servers/${serverId}/access-tokens`,
  {
    headers: {
      'X-Api-Key': 'YOUR_APP_KEY',
      'Authorization': 'Bearer USER_SESSION_TOKEN',
    },
  }
)
const { data } = await res.json()
```

## Response fields

| Field | Type | Description |
|------|-----|----------|
| `success` | boolean | Always `true` on success |
| `data.tokens` | array | Array of tokens |
| `data.tokens[].id` | string | Token ID |
| `data.tokens[].mode` | string | `"api-bearer"` or `"share-url"` |
| `data.tokens[].name` | string \| null | Token label |
| `data.tokens[].identityBound` | boolean | For `api-bearer` always `true`; for `share-url` — whether login via Bitrix24 is required |
| `data.tokens[].shortcode` | string \| null | Link code for `share-url`; `null` for `api-bearer` |
| `data.tokens[].expiresAt` | string (ISO 8601) | Expiration timestamp |
| `data.tokens[].revokedAt` | string (ISO 8601) \| null | Revocation timestamp; `null` if not revoked |
| `data.tokens[].createdAt` | string (ISO 8601) | Mint timestamp |
| `data.tokens[].lastUsedAt` | string (ISO 8601) \| null | Last use |
| `data.tokens[].sessionCount` | number | Number of sessions created through this token |
| `data.tokens[].createdBy.id` | string | ID of the user who minted the token |
| `data.tokens[].createdBy.name` | string | User name |
| `data.tokens[].createdBy.email` | string | User email |
| `data.limits.activeCount` | number | Current number of active server tokens |
| `data.limits.activeCountMax` | number | Active token limit per server (100) |
| `data.limits.mintRateLimitPerHour` | number | Mint limit per hour per API key (50) |
| `data.limits.mintsLastHour` | number | Number of tokens minted in the last hour for this API key |

## Response example

```json
{
  "success": true,
  "data": {
    "tokens": [
      {
        "id": "tk_7d3fa2b1",
        "mode": "api-bearer",
        "name": "ci-smoke",
        "identityBound": true,
        "shortcode": null,
        "expiresAt": "2026-05-18T10:50:00.000Z",
        "revokedAt": null,
        "createdAt": "2026-05-18T10:40:00.000Z",
        "lastUsedAt": "2026-05-18T10:41:30.000Z",
        "sessionCount": 1,
        "createdBy": { "id": "usr_abc123", "name": "John Brown", "email": "john@example.bitrix24.com" }
      },
      {
        "id": "tk_8e4gb3c2",
        "mode": "share-url",
        "name": "preview",
        "identityBound": false,
        "shortcode": "R8k3Zm2P",
        "expiresAt": "2026-06-17T08:44:00.000Z",
        "revokedAt": null,
        "createdAt": "2026-05-18T08:44:00.000Z",
        "lastUsedAt": null,
        "sessionCount": 0,
        "createdBy": { "id": "usr_abc123", "name": "John Brown", "email": "john@example.bitrix24.com" }
      }
    ],
    "limits": {
      "activeCount": 2,
      "activeCountMax": 100,
      "mintRateLimitPerHour": 50,
      "mintsLastHour": 1
    }
  }
}
```

## Error response example

404 — server not found:

```json
{
  "success": false,
  "error": {
    "code": "SERVER_NOT_FOUND",
    "message": "Server not found"
  }
}
```

## Errors

| HTTP | Code | Description |
|------|-----|----------|
| 401 | `MISSING_API_KEY` | The `X-Api-Key` header was not provided |
| 401 | `INVALID_API_KEY` | Invalid or expired API key |
| 403 | `TOKEN_OWNER_MISMATCH` | The server belongs to a different API key |
| 404 | `SERVER_NOT_FOUND` | Server not found or deleted |

Full list of common API errors — [Errors](/docs/errors).

## Known specifics

- **The `token` field (JWT) is not included in the list.** The JWT value is returned only when the token is minted.
- **`status=all` returns expired and revoked tokens.** A token's status is derived from the `revokedAt` (not `null` → revoked) and `expiresAt` (earlier than the current time → expired) fields.
- **The list is capped at 500 tokens.** The `status` filter narrows the selection to the desired category.

## See also

- [Mint a token](./create.md)
- [Revoke a token](./delete.md)
- [Access tokens](/docs/infra/access-tokens)