personal_access_tokens.md

stage	group	info
Manage	Compliance	To determine the technical writer assigned to the Stage/Group associated with this page, see https://about.gitlab.com/handbook/engineering/ux/technical-writing/#assignments

Personal access tokens API

You can read more about personal access tokens.

List personal access tokens

• Introduced in GitLab Ultimate 13.3.
• Moved to GitLab Core in 13.6.

Get a list of personal access tokens.

GET /personal_access_tokens

Attribute	Type	required	Description
user_id	integer/string	no	The ID of the user to filter by

NOTE: Note: Administrators can use the user_id parameter to filter by a user. Non-administrators cannot filter by any user except themselves. Attempting to do so will result in a 401 Unauthorized response.

curl --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/api/v4/personal_access_tokens"

[
    {
        "id": 4,
        "name": "Test Token",
        "revoked": false,
        "created_at": "2020-07-23T14:31:47.729Z",
        "scopes": [
            "api"
        ],
        "active": true,
        "user_id": 24,
        "expires_at": null
    }
]

curl --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/api/v4/personal_access_tokens?user_id=3"

[
    {
        "id": 4,
        "name": "Test Token",
        "revoked": false,
        "created_at": "2020-07-23T14:31:47.729Z",
        "scopes": [
            "api"
        ],
        "active": true,
        "user_id": 3,
        "expires_at": null
    }
]

Revoke a personal access token

Introduced in GitLab Ultimate 13.3.

Revoke a personal access token.

DELETE /personal_access_tokens/:id

Attribute	Type	required	Description
id	integer/string	yes	ID of personal access token

NOTE: Note: Non-administrators can revoke their own tokens. Administrators can revoke tokens of any user.

curl --request DELETE --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/api/v4/personal_access_tokens/<personal_access_token_id>"

Responses

• 204: No Content if successfully revoked.
• 400 Bad Request if not revoked successfully.

Create a personal access token (admin only)

See the Users API documentation for information on creating a personal access token.