For AI agents: markdown of this page — /docs-content-en/infra/access-tokens/list.md documentation index — /llms.txt

List server tokens

GET /v1/infra/servers/:id/access-tokens

Returns the server's tokens filtered by status. By default, only active tokens are returned.

Parameters

Parameter In Type Required Description
id path string (UUID) yes BLACKHOLE server ID. List: GET /v1/infra/servers
status query string no Filter: active (default) | expired | revoked | all. A value outside this set is not rejected — the query then behaves as if all were passed

Examples

curl — personal key

Terminal 
curl -H "X-Api-Key: YOUR_API_KEY" \
  "https://vibecode.bitrix24.com/v1/infra/servers/SERVER_ID/access-tokens?status=active"

curl — OAuth application

Terminal 
curl -H "X-Api-Key: YOUR_APP_KEY" \
  -H "Authorization: Bearer USER_SESSION_TOKEN" \
  "https://vibecode.bitrix24.com/v1/infra/servers/SERVER_ID/access-tokens?status=all"

JavaScript — personal key

javascript 
const res = await fetch(
  `https://vibecode.bitrix24.com/v1/infra/servers/${serverId}/access-tokens?status=active`,
  { headers: { 'X-Api-Key': 'YOUR_API_KEY' } }
)
const { data } = await res.json()
console.log(`Active tokens: ${data.tokens.length} / ${data.limits.activeCountMax}`)

JavaScript — OAuth application

javascript 
const res = await fetch(
  `https://vibecode.bitrix24.com/v1/infra/servers/${serverId}/access-tokens`,
  {
    headers: {
      'X-Api-Key': 'YOUR_APP_KEY',
      'Authorization': 'Bearer USER_SESSION_TOKEN',
    },
  }
)
const { data } = await res.json()

Response fields

Field Type Description
success boolean Always true on success
data.tokens array Array of tokens
data.tokens[].id string Token ID
data.tokens[].mode string "api-bearer" or "share-url"
data.tokens[].createdVia string Where the token was minted from: PLATFORM — via the API or the Vibecode interface, BITRIX24_PORTAL — from the Bitrix24 side when an application link is published
data.tokens[].name string | null Token label
data.tokens[].identityBound boolean For api-bearer always true; for share-url — whether login via Bitrix24 is required
data.tokens[].shortcode string | null Link code for share-url; null for api-bearer
data.tokens[].expiresAt string (ISO 8601) Expiration timestamp
data.tokens[].revokedAt string (ISO 8601) | null Revocation timestamp; null if not revoked
data.tokens[].createdAt string (ISO 8601) Mint timestamp
data.tokens[].lastUsedAt string (ISO 8601) | null Last use timestamp
data.tokens[].sessionCount number Number of sessions created through this token
data.tokens[].createdBy.id string ID of the user who minted the token
data.tokens[].createdBy.name string User name
data.tokens[].createdBy.email string User email
data.limits.activeCount number Current number of the server's active tokens
data.limits.activeCountMax number Active token limit per server (100)
data.limits.mintRateLimitPerHour number Hourly mint limit per API key (50)
data.limits.mintsLastHour number Number of tokens minted in the last hour for this API key

Response example

JSON 
{
  "success": true,
  "data": {
    "tokens": [
      {
        "id": "9f1c4b7e-3d52-4a18-9c0e-7b2a1f6d84c3",
        "mode": "api-bearer",
        "createdVia": "PLATFORM",
        "name": "ci-smoke",
        "identityBound": true,
        "shortcode": null,
        "expiresAt": "2026-05-18T10:50:00.000Z",
        "revokedAt": null,
        "createdAt": "2026-05-18T10:40:00.000Z",
        "lastUsedAt": "2026-05-18T10:41:30.000Z",
        "sessionCount": 1,
        "createdBy": { "id": "c4e8b1a7-6f30-4d92-8a15-3b7e0c2d94f6", "name": "John Brown", "email": "john@example.bitrix24.com" }
      },
      {
        "id": "2a7d5e61-84bc-4f39-b0d7-5e6c9a3f1b28",
        "mode": "share-url",
        "createdVia": "BITRIX24_PORTAL",
        "name": "preview",
        "identityBound": false,
        "shortcode": "R8k3Zm2P",
        "expiresAt": "2026-06-17T08:44:00.000Z",
        "revokedAt": null,
        "createdAt": "2026-05-18T08:44:00.000Z",
        "lastUsedAt": null,
        "sessionCount": 0,
        "createdBy": { "id": "c4e8b1a7-6f30-4d92-8a15-3b7e0c2d94f6", "name": "John Brown", "email": "john@example.bitrix24.com" }
      }
    ],
    "limits": {
      "activeCount": 2,
      "activeCountMax": 100,
      "mintRateLimitPerHour": 50,
      "mintsLastHour": 1
    }
  }
}

Error response example

404 — server not found:

JSON 
{
  "success": false,
  "error": {
    "code": "SERVER_NOT_FOUND",
    "message": "Server not found"
  }
}

Errors

HTTP Code Description
401 MISSING_API_KEY The X-Api-Key header was not provided
401 INVALID_API_KEY Invalid or expired API key
403 TOKEN_OWNER_MISMATCH The server belongs to a different API key. Being on the server's development team does not grant access to this operation — it requires the managing key regardless of your role.
404 SERVER_NOT_FOUND Server not found or deleted
503 FEATURE_DISABLED The access-tokens section is disabled on the platform. The pre-call signal and the fallback are described in Availability

Full list of common API errors — Errors.

Known specifics

  • The token field (JWT) is not included in the list. The JWT is returned only in the response to minting or refreshing a token.
  • status=all returns expired and revoked tokens. A token's status is derived from the revokedAt (not null → revoked) and expiresAt (earlier than the current time → expired) fields.
  • The list is capped at 500 tokens. The status filter narrows the selection to the desired category.

See also