For AI agents: markdown of this page — /docs-content-en/infra/access-tokens/list.md documentation index — /llms.txt

List server tokens

GET /v1/infra/servers/:id/access-tokens

Returns the server's tokens filtered by status. By default, only active tokens are returned.

Parameters

Parameter In Type Required Description
id path string (UUID) yes BLACKHOLE server ID
status query string no Filter: active (default) | expired | revoked | all

Examples

curl — personal key

Terminal 
curl -H "X-Api-Key: YOUR_API_KEY" \
  "https://vibecode.bitrix24.com/v1/infra/servers/SERVER_ID/access-tokens?status=active"

curl — OAuth application

Terminal 
curl -H "X-Api-Key: YOUR_APP_KEY" \
  -H "Authorization: Bearer USER_SESSION_TOKEN" \
  "https://vibecode.bitrix24.com/v1/infra/servers/SERVER_ID/access-tokens?status=all"

JavaScript — personal key

javascript 
const res = await fetch(
  `https://vibecode.bitrix24.com/v1/infra/servers/${serverId}/access-tokens?status=active`,
  { headers: { 'X-Api-Key': 'YOUR_API_KEY' } }
)
const { data } = await res.json()
console.log(`Active tokens: ${data.tokens.length} / ${data.limits.activeCountMax}`)

JavaScript — OAuth application

javascript 
const res = await fetch(
  `https://vibecode.bitrix24.com/v1/infra/servers/${serverId}/access-tokens`,
  {
    headers: {
      'X-Api-Key': 'YOUR_APP_KEY',
      'Authorization': 'Bearer USER_SESSION_TOKEN',
    },
  }
)
const { data } = await res.json()

Response fields

Field Type Description
success boolean Always true on success
data.tokens array Array of tokens
data.tokens[].id string Token ID
data.tokens[].mode string "api-bearer" or "share-url"
data.tokens[].name string | null Token label
data.tokens[].identityBound boolean For api-bearer always true; for share-url — whether login via Bitrix24 is required
data.tokens[].shortcode string | null Link code for share-url; null for api-bearer
data.tokens[].expiresAt string (ISO 8601) Expiration timestamp
data.tokens[].revokedAt string (ISO 8601) | null Revocation timestamp; null if not revoked
data.tokens[].createdAt string (ISO 8601) Mint timestamp
data.tokens[].lastUsedAt string (ISO 8601) | null Last use
data.tokens[].sessionCount number Number of sessions created through this token
data.tokens[].createdBy.id string ID of the user who minted the token
data.tokens[].createdBy.name string User name
data.tokens[].createdBy.email string User email
data.limits.activeCount number Current number of active server tokens
data.limits.activeCountMax number Active token limit per server (100)
data.limits.mintRateLimitPerHour number Mint limit per hour per API key (50)
data.limits.mintsLastHour number Number of tokens minted in the last hour for this API key

Response example

JSON 
{
  "success": true,
  "data": {
    "tokens": [
      {
        "id": "tk_7d3fa2b1",
        "mode": "api-bearer",
        "name": "ci-smoke",
        "identityBound": true,
        "shortcode": null,
        "expiresAt": "2026-05-18T10:50:00.000Z",
        "revokedAt": null,
        "createdAt": "2026-05-18T10:40:00.000Z",
        "lastUsedAt": "2026-05-18T10:41:30.000Z",
        "sessionCount": 1,
        "createdBy": { "id": "usr_abc123", "name": "John Brown", "email": "john@example.bitrix24.com" }
      },
      {
        "id": "tk_8e4gb3c2",
        "mode": "share-url",
        "name": "preview",
        "identityBound": false,
        "shortcode": "R8k3Zm2P",
        "expiresAt": "2026-06-17T08:44:00.000Z",
        "revokedAt": null,
        "createdAt": "2026-05-18T08:44:00.000Z",
        "lastUsedAt": null,
        "sessionCount": 0,
        "createdBy": { "id": "usr_abc123", "name": "John Brown", "email": "john@example.bitrix24.com" }
      }
    ],
    "limits": {
      "activeCount": 2,
      "activeCountMax": 100,
      "mintRateLimitPerHour": 50,
      "mintsLastHour": 1
    }
  }
}

Error response example

404 — server not found:

JSON 
{
  "success": false,
  "error": {
    "code": "SERVER_NOT_FOUND",
    "message": "Server not found"
  }
}

Errors

HTTP Code Description
401 MISSING_API_KEY The X-Api-Key header was not provided
401 INVALID_API_KEY Invalid or expired API key
403 TOKEN_OWNER_MISMATCH The server belongs to a different API key
404 SERVER_NOT_FOUND Server not found or deleted

Full list of common API errors — Errors.

Known specifics

  • The token field (JWT) is not included in the list. The JWT value is returned only when the token is minted.
  • status=all returns expired and revoked tokens. A token's status is derived from the revokedAt (not null → revoked) and expiresAt (earlier than the current time → expired) fields.
  • The list is capped at 500 tokens. The status filter narrows the selection to the desired category.

See also