Personal-Access-Tokens

Endpoints for Personal-Access-Tokens

ReferenceUpdated October 13, 2026View as Markdown

GET/api/v1/users/me/personal-access-tokens

Authentication: Bearer token (JWT)

Responses

4 status codes

Responses 200

Status200 401 403 500application/json

Schema Examplearray of PersonalAccessTokenResponseDto

9 top-level fields

idnumberRequired when parent is present
namestringRequired when parent is present
maskedTokenstringRequired when parent is present
Masked token, e.g. sbr_pat_7f4c…a91d
statusPersonalAccessTokenStatusRequired when parent is present
Allowed values: "active", "revoked", "expired"
accessLevelPersonalAccessTokenAccessLevelRequired when parent is present
Allowed values: "read", "write", "both"
createdAtstring (date-time)Required when parent is present
lastUsedAtstring (date-time)Required when parent is present
Can be null
expiresAtstring (date-time)Required when parent is present
Can be null
revokedAtstring (date-time)Required when parent is present
Can be null

9 documented fields · Scroll to see moreShow full heightShow compact view

Schema Examplearray of PersonalAccessTokenResponseDto

200 · application/json

[
  {
    "id": 0,
    "name": "string",
    "maskedToken": "<maskedToken>",
    "status": "active",
    "accessLevel": "read",
    "createdAt": "2019-08-24T14:15:22Z",
    "lastUsedAt": "2019-08-24T14:15:22Z",
    "expiresAt": "2019-08-24T14:15:22Z",
    "revokedAt": "2019-08-24T14:15:22Z"
  }
]

Example · 13 linesShow full heightShow compact view

Responses 401

unauthorized

This response has no body.

Responses 403

Status200 401 403 500application/json

forbidden

Schema ExampleErrorResponse

3 top-level fieldsSelect an object to expand

messageCodestringRequired
messagestring
errorsarray of FieldErrorRequired7 fields
errors
- fieldstringRequired when parent is presentField path: errors[].field
- fieldValuestringRequired when parent is presentField path: errors[].fieldValue
- identifierstringRequired when parent is presentField path: errors[].identifier
- identifierValuestringRequired when parent is presentField path: errors[].identifierValue
- messageCodestringRequired when parent is presentField path: errors[].messageCode
- messagestringField path: errors[].message
- errorTypestringRequired when parent is presentField path: errors[].errorType

10 documented fields · Scroll to see moreShow full heightShow compact view

Schema ExampleErrorResponse

403 · application/json

{
  "messageCode": "string",
  "message": "string",
  "errors": [
    {}
  ]
}

Example · 7 linesShow full heightShow compact view

Responses 500

Status200 401 403 500application/json

internalServerError

SchemaErrorResponse

Same fields as Get the signed-in user's own personal access tokens (403).

Example requestcurl

curl

curl https://api.subrite.no/api/v1/users/me/personal-access-tokens \
  --header 'Authorization: Bearer <token>'

Try it

Create a personal access token. The token value is returned only in this response.#

POST/api/v1/users/me/personal-access-tokens

Authentication: Bearer token (JWT)

Request body

Required bodyapplication/json

Schema ExampleCreatePersonalAccessTokenRequestDto

3 top-level fields

namestringRequired
Identifies where the token is used, e.g. the MCP client name.maxLength: 255
expiresAtstring (date-time)Optional
When the token stops working. Omit for a token that never expires.
accessLevelPersonalAccessTokenAccessLevelRequired
How much of your access the token may use. Never widens your own permissions — it only narrows them, so a 'both' token still cannot do what your role does not grant.Allowed values: "read", "write", "both"

3 documented fields · Scroll to see moreShow full heightShow compact view

Schema ExampleCreatePersonalAccessTokenRequestDto

application/json

{
  "name": "string",
  "expiresAt": "2019-08-24T14:15:22Z",
  "accessLevel": "read"
}

Example · 5 linesShow full heightShow compact view

Responses

4 status codes

Responses 201

Status201 401 403 500application/json

Schema ExampleCreatePersonalAccessTokenResponseDto

10 top-level fields

idnumberRequired
namestringRequired
maskedTokenstringRequired
Masked token, e.g. sbr_pat_7f4c…a91d
statusPersonalAccessTokenStatusRequired
Allowed values: "active", "revoked", "expired"
accessLevelPersonalAccessTokenAccessLevelRequired
Allowed values: "read", "write", "both"
createdAtstring (date-time)Required
lastUsedAtstring (date-time)Required
Can be null
expiresAtstring (date-time)Required
Can be null
revokedAtstring (date-time)Required
Can be null
tokenstringRequired
The token value. Shown only in this response and never retrievable again.

10 documented fields · Scroll to see moreShow full heightShow compact view

Schema ExampleCreatePersonalAccessTokenResponseDto

201 · application/json

{
  "id": 0,
  "name": "string",
  "maskedToken": "<maskedToken>",
  "status": "active",
  "accessLevel": "read",
  "createdAt": "2019-08-24T14:15:22Z",
  "lastUsedAt": "2019-08-24T14:15:22Z",
  "expiresAt": "2019-08-24T14:15:22Z",
  "revokedAt": "2019-08-24T14:15:22Z",
  "token": "<token>"
}

Example · 12 linesShow full heightShow compact view

Responses 401

unauthorized

This response has no body.

Responses 403

Status201 401 403 500application/json

forbidden

Schema ExampleErrorResponse

Same fields as Get the signed-in user's own personal access tokens (403).

Schema ExampleErrorResponse

403 · application/json

{
  "messageCode": "string",
  "message": "string",
  "errors": [
    {}
  ]
}

Example · 7 linesShow full heightShow compact view

Responses 500

Status201 401 403 500application/json

internalServerError

SchemaErrorResponse

Same fields as Get the signed-in user's own personal access tokens (403).

Example requestcurl

curl

curl https://api.subrite.no/api/v1/users/me/personal-access-tokens \
  --request POST \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{
  "name": "string",
  "expiresAt": "2019-08-24T14:15:22Z",
  "accessLevel": "read"
}'

Try it

Revoke a personal access token. It stays listed until deleted.#

POST/api/v1/users/me/personal-access-tokens/{id}/revoke

Authentication: Bearer token (JWT)

Parameters

Path parameters1

idnumberRequired

Responses

5 status codes

Responses 201

Status201 401 403 404 500application/json

Schema ExamplePersonalAccessTokenResponseDto

9 top-level fields

idnumberRequired
namestringRequired
maskedTokenstringRequired
Masked token, e.g. sbr_pat_7f4c…a91d
statusPersonalAccessTokenStatusRequired
Allowed values: "active", "revoked", "expired"
accessLevelPersonalAccessTokenAccessLevelRequired
Allowed values: "read", "write", "both"
createdAtstring (date-time)Required
lastUsedAtstring (date-time)Required
Can be null
expiresAtstring (date-time)Required
Can be null
revokedAtstring (date-time)Required
Can be null

9 documented fields · Scroll to see moreShow full heightShow compact view

Schema ExamplePersonalAccessTokenResponseDto

201 · application/json

{
  "id": 0,
  "name": "string",
  "maskedToken": "<maskedToken>",
  "status": "active",
  "accessLevel": "read",
  "createdAt": "2019-08-24T14:15:22Z",
  "lastUsedAt": "2019-08-24T14:15:22Z",
  "expiresAt": "2019-08-24T14:15:22Z",
  "revokedAt": "2019-08-24T14:15:22Z"
}

Example · 11 linesShow full heightShow compact view

Responses 401

unauthorized

This response has no body.

Responses 403

Status201 401 403 404 500application/json

forbidden

Schema ExampleErrorResponse

Same fields as Get the signed-in user's own personal access tokens (403).

Schema ExampleErrorResponse

403 · application/json

{
  "messageCode": "string",
  "message": "string",
  "errors": [
    {}
  ]
}

Example · 7 linesShow full heightShow compact view

Responses 404

Status201 401 403 404 500application/json

personalAccessTokenNotFound

SchemaErrorResponse

Same fields as Get the signed-in user's own personal access tokens (403).

Responses 500

Status201 401 403 404 500application/json

internalServerError

SchemaErrorResponse

Same fields as Get the signed-in user's own personal access tokens (403).

Example requestcurl

curl

curl 'https://api.subrite.no/api/v1/users/me/personal-access-tokens/{id}/revoke' \
  --request POST \
  --header 'Authorization: Bearer <token>'

Try it

DELETE/api/v1/users/me/personal-access-tokens/{id}

Authentication: Bearer token (JWT)

Parameters

Path parameters1

idnumberRequired

Responses

5 status codes

Responses 204

This response has no body.

Responses 401

unauthorized

This response has no body.

Responses 403

Status204 401 403 404 500application/json

forbidden

Schema ExampleErrorResponse

Same fields as Get the signed-in user's own personal access tokens (403).

Schema ExampleErrorResponse

403 · application/json

{
  "messageCode": "string",
  "message": "string",
  "errors": [
    {}
  ]
}

Example · 7 linesShow full heightShow compact view

Responses 404

Status204 401 403 404 500application/json

personalAccessTokenNotFound

SchemaErrorResponse

Same fields as Get the signed-in user's own personal access tokens (403).

Responses 500

Status204 401 403 404 500application/json

internalServerError

SchemaErrorResponse

Same fields as Get the signed-in user's own personal access tokens (403).

Example requestcurl

curl

curl 'https://api.subrite.no/api/v1/users/me/personal-access-tokens/{id}' \
  --request DELETE \
  --header 'Authorization: Bearer <token>'

Try it

Get the signed-in user's own personal access tokens#

Responses

Responses 200

Responses 401

Responses 403

Responses 500

Create a personal access token. The token value is returned only in this response.#

Request body

Responses

Responses 201

Responses 401

Responses 403

Responses 500

Revoke a personal access token. It stays listed until deleted.#

Parameters

Responses

Responses 201

Responses 401

Responses 403

Responses 404

Responses 500

Delete a personal access token#

Parameters

Responses

Responses 204

Responses 401

Responses 403

Responses 404

Responses 500

Get the signed-in user's own personal access tokens#

Responses

Responses 200

Responses 401

Responses 403

Responses 500

Create a personal access token. The token value is returned only in this response.#

Request body

Responses

Responses 201

Responses 401

Responses 403

Responses 500

Revoke a personal access token. It stays listed until deleted.#

Parameters

Responses

Responses 201

Responses 401

Responses 403

Responses 404

Responses 500

Delete a personal access token#

Parameters

Responses

Responses 204

Responses 401

Responses 403

Responses 404

Responses 500