For AI agents: markdown of this page — /docs-content-en/infra/access-tokens/list.md documentation index — /llms.txt

List server tokens

GET /v1/infra/servers/:id/access-tokens

Returns the server's tokens filtered by status. By default, only active tokens are returned.

Parameters

Parameter In Type Required Description
Parameterid Inpath Typestring (UUID) Requiredyes DescriptionBLACKHOLE server ID. List: GET /v1/infra/servers
Parameterstatus Inquery Typestring Requiredno DescriptionFilter: active (default) | expired | revoked | all. A value outside this set is not rejected — the query then behaves as if all were passed

Examples

curl — personal key

Terminal 
curl -H "X-Api-Key: YOUR_API_KEY" \
  "https://vibecode.bitrix24.com/v1/infra/servers/SERVER_ID/access-tokens?status=active"

curl — OAuth application

Terminal 
curl -H "X-Api-Key: YOUR_APP_KEY" \
  -H "Authorization: Bearer USER_SESSION_TOKEN" \
  "https://vibecode.bitrix24.com/v1/infra/servers/SERVER_ID/access-tokens?status=active"

JavaScript — personal key

javascript 
const res = await fetch(
  `https://vibecode.bitrix24.com/v1/infra/servers/${serverId}/access-tokens?status=active`,
  { headers: { 'X-Api-Key': 'YOUR_API_KEY' } }
)
const result = await res.json()
if (!res.ok || result.success !== true) {
  throw new Error(result.error?.code ?? `HTTP_${res.status}`)
}
const { data } = result
console.log(`Active tokens: ${data.tokens.length} / ${data.limits.activeCountMax}`)

JavaScript — OAuth application

javascript 
const res = await fetch(
  `https://vibecode.bitrix24.com/v1/infra/servers/${serverId}/access-tokens?status=active`,
  {
    headers: {
      'X-Api-Key': 'YOUR_APP_KEY',
      'Authorization': 'Bearer USER_SESSION_TOKEN',
    },
  }
)
const result = await res.json()
if (!res.ok || result.success !== true) {
  throw new Error(result.error?.code ?? `HTTP_${res.status}`)
}
const { data } = result
console.log(`Active tokens: ${data.tokens.length} / ${data.limits.activeCountMax}`)

Response fields

Field Type Description
Fieldsuccess Typeboolean DescriptionAlways true on success
Fielddata.tokens Typearray DescriptionArray of tokens
Fielddata.tokens[].id Typestring DescriptionToken ID
Fielddata.tokens[].mode Typestring Description"api-bearer" or "share-url"
Fielddata.tokens[].createdVia Typestring DescriptionWhere the token was minted from: PLATFORM — via the API or the Vibecode interface, BITRIX24_PORTAL — from the Bitrix24 side when an application link is published
Fielddata.tokens[].name Typestring | null DescriptionToken label
Fielddata.tokens[].identityBound Typeboolean DescriptionFor api-bearer always true; for share-url — whether login via Bitrix24 is required
Fielddata.tokens[].shortcode Typestring | null DescriptionLink code for share-url; null for api-bearer
Fielddata.tokens[].expiresAt Typestring (ISO 8601) DescriptionExpiration timestamp
Fielddata.tokens[].revokedAt Typestring (ISO 8601) | null DescriptionRevocation timestamp; null if not revoked
Fielddata.tokens[].createdAt Typestring (ISO 8601) DescriptionMint timestamp
Fielddata.tokens[].lastUsedAt Typestring (ISO 8601) | null DescriptionLast use timestamp
Fielddata.tokens[].sessionCount Typenumber DescriptionNumber of sessions created through this token
Fielddata.tokens[].createdBy.id Typestring DescriptionID of the user who minted the token
Fielddata.tokens[].createdBy.name Typestring DescriptionUser name
Fielddata.tokens[].createdBy.email Typestring DescriptionUser email
Fielddata.limits.activeCount Typenumber DescriptionCurrent number of the server's active tokens
Fielddata.limits.activeCountMax Typenumber DescriptionActive token limit per server (100)
Fielddata.limits.mintRateLimitPerHour Typenumber DescriptionHourly mint limit per API key (50)
Fielddata.limits.mintsLastHour Typenumber DescriptionNumber of tokens minted in the last hour for this API key

Response example

JSON 
{
  "success": true,
  "data": {
    "tokens": [
      {
        "id": "9f1c4b7e-3d52-4a18-9c0e-7b2a1f6d84c3",
        "mode": "api-bearer",
        "createdVia": "PLATFORM",
        "name": "ci-smoke",
        "identityBound": true,
        "shortcode": null,
        "expiresAt": "2026-05-18T10:50:00.000Z",
        "revokedAt": null,
        "createdAt": "2026-05-18T10:40:00.000Z",
        "lastUsedAt": "2026-05-18T10:41:30.000Z",
        "sessionCount": 1,
        "createdBy": { "id": "c4e8b1a7-6f30-4d92-8a15-3b7e0c2d94f6", "name": "John Brown", "email": "john@example.bitrix24.com" }
      },
      {
        "id": "2a7d5e61-84bc-4f39-b0d7-5e6c9a3f1b28",
        "mode": "share-url",
        "createdVia": "BITRIX24_PORTAL",
        "name": "preview",
        "identityBound": false,
        "shortcode": "R8k3Zm2P",
        "expiresAt": "2026-06-17T08:44:00.000Z",
        "revokedAt": null,
        "createdAt": "2026-05-18T08:44:00.000Z",
        "lastUsedAt": null,
        "sessionCount": 0,
        "createdBy": { "id": "c4e8b1a7-6f30-4d92-8a15-3b7e0c2d94f6", "name": "John Brown", "email": "john@example.bitrix24.com" }
      }
    ],
    "limits": {
      "activeCount": 2,
      "activeCountMax": 100,
      "mintRateLimitPerHour": 50,
      "mintsLastHour": 1
    }
  }
}

Error response example

404 — server not found:

JSON 
{
  "success": false,
  "error": {
    "code": "SERVER_NOT_FOUND",
    "message": "Server not found"
  }
}

Errors

HTTP Code Description
HTTP401 CodeMISSING_API_KEY DescriptionNo API key was supplied through X-Api-Key or a supported Authorization: Bearer scheme
HTTP401 CodeINVALID_API_KEY DescriptionThe authentication key is not recognized
HTTP401 CodeKEY_INACTIVE DescriptionThe requesting API key is no longer active
HTTP401 CodeKEY_EXPIRED DescriptionThe requesting API key has expired; this is distinct from resource URL expiry
HTTP401 CodeNO_PORTAL DescriptionA non-management key has no portal binding
HTTP401 CodeCOWORK_CHAT_KEY_INACTIVE DescriptionThe parent device key behind a Cowork chat key is no longer usable
HTTP401 CodeWRONG_AUTH_SCHEME DescriptionAn OAuth application key was sent as a Bearer session: put the key in X-Api-Key and the session in Authorization: Bearer
HTTP401 CodeINVALID_SESSION DescriptionThe supplied OAuth session is invalid or expired
HTTP401 CodeTOKEN_EXPIRED DescriptionThe OAuth user token expired and its refresh failed; re-authorization is required
HTTP401 CodeTOKEN_INVALID DescriptionWhen the partner AI plane is enabled, its supplied token is unknown or expired
HTTP401 CodeKEY_REVOKED DescriptionThe partner credential behind the AI plane token is revoked
HTTP402 CodeACCOUNT_FROZEN DescriptionThe key owner’s account is frozen. With wallet-debt scoping disabled, the shared API-key guard refuses this call before its handler. Follow error.topupUrl to resolve the balance; this status alone does not authorize repeating a prior write.
HTTP403 CodeTOKEN_OWNER_MISMATCH DescriptionThe server belongs to a different API key. Being on the server's development team does not grant access to this operation — it requires the managing key regardless of your role.
HTTP403 CodePORTAL_COLLABORATOR_KEY_OUT_OF_SCOPE DescriptionThis operation is outside the development-team key route list. Use the key that manages the server
HTTP403 CodeEXTERNAL_COLLABORATOR_KEY_OUT_OF_SCOPE DescriptionThis operation is outside the external-collaborator key route list. Use the key that manages the server
HTTP403 CodeIP_NOT_ALLOWED DescriptionThe caller IP is outside the key allowlist.
HTTP403 CodeOWNER_BLOCKED DescriptionThe key owner is blocked.
HTTP403 CodeOWNER_DELETED DescriptionThe key owner was deleted.
HTTP403 CodePORTAL_SUSPENDED DescriptionThe bound portal is suspended.
HTTP403 CodePORTAL_DELETED DescriptionThe bound portal was deleted.
HTTP403 CodePORTAL_BLOCKED DescriptionThe bound portal is blocked.
HTTP403 CodeMANAGEMENT_KEY_NO_ENTITY_ACCESS DescriptionThe management key lacks the portal binding or entity authority required by this call.
HTTP403 CodeAGENT_MAINTENANCE_KEY_OUT_OF_SCOPE DescriptionThe maintenance key route list does not include this operation.
HTTP403 CodeAPP_API_KEY_OUT_OF_SCOPE DescriptionThe application key route list does not include this operation.
HTTP403 CodeWAITLIST_PENDING DescriptionThe key owner has not been activated.
HTTP403 CodeSESSION_APP_MISMATCH DescriptionThe OAuth session belongs to another application.
HTTP403 CodePLANE_FORBIDDEN DescriptionThe partner key does not allow this AI plane.
HTTP403 CodeSYSTEM_FORBIDDEN DescriptionThe partner key does not allow this AI system.
HTTP403 CodeSCOPE_FORBIDDEN DescriptionThe partner AI plane forbids this route.
HTTP403 CodeCONNECT_COMPANY_DERIVED_TOKEN_FORBIDDEN DescriptionA company connection key cannot manage derived tokens.
HTTP404 CodeSERVER_NOT_FOUND DescriptionServer not found or deleted
HTTP404 CodeNOT_FOUND DescriptionThe server's portal has been deactivated
HTTP429 CodeQUOTA_EXCEEDED DescriptionAPI billing is enabled with a nonzero overage price: the daily free quota is exhausted and the PREPAY balance is not positive. Top up the balance. error.quota and error.used report counts; X-RateLimit-Quota, X-RateLimit-Used and X-RateLimit-Remaining report the quota, usage and zero remainder. This refusal does not promise Retry-After or X-RateLimit-Scope
HTTP429 CodeCALLER_RATE_LIMITED DescriptionThe shared key or user request limit. Wait for the number of seconds specified in Retry-After; X-RateLimit-Scope identifies the refusing layer
HTTP503 CodeFEATURE_DISABLED DescriptionThe access-tokens section is disabled on the platform. The pre-call signal and the fallback are described in Availability
HTTP503 CodeACCOUNT_PENDING_ERASURE DescriptionThe key owner is pending erasure or being erased. Header Retry-After: 3600.
HTTP503 CodeSERVICE_DISABLED DescriptionThe partner AI plane or its quota-readiness service is disabled. No Retry-After is promised for this refusal.
HTTP503 Codeuser_self_deletion_pending DescriptionThe API key owner scheduled self-deletion. The token plugin refuses the call before its handler. Header Retry-After: 604800.

Full list of common API errors — Errors.

Known specifics

  • The token field (JWT) is not included in the list. The JWT is returned only in the response to minting or refreshing a token.
  • status=all returns expired and revoked tokens. A token's status is derived from the revokedAt (not null → revoked) and expiresAt (earlier than the current time → expired) fields.
  • The list is capped at 500 tokens. The status filter narrows the selection to the desired category.

See also