# Personal-Access-Tokens

**Summary:** Endpoints for Personal-Access-Tokens

- Role: [Developers](https://www.subrite.no/developers)
- Source: https://www.subrite.no/developers/personal-access-tokens
- Updated: 2026-10-13
- Markdown index: https://www.subrite.no/developers/llms.txt

<a id="get-api-v1-users-me-personal-access-tokens"></a>
## Get the signed-in user's own personal access tokens

`GET /api/v1/users/me/personal-access-tokens`

**Authentication:** Bearer token (JWT)

### Responses

#### 200

Content type: `application/json` · `array of PersonalAccessTokenResponseDto`

| Name | Type | Description |
| --- | --- | --- |
| `[].id` (Required when parent is present) | `number` |   |
| `[].name` (Required when parent is present) | `string` |   |
| `[].maskedToken` (Required when parent is present) | `string` | Masked token, e.g. sbr\_pat\_7f4c…a91d |
| `[].status` (Required when parent is present) | `PersonalAccessTokenStatus` | Allowed values: `"active"`, `"revoked"`, `"expired"` |
| `[].accessLevel` (Required when parent is present) | `PersonalAccessTokenAccessLevel` | Allowed values: `"read"`, `"write"`, `"both"` |
| `[].createdAt` (Required when parent is present) | `string (date-time)` |   |
| `[].lastUsedAt` (Required when parent is present) | `string (date-time)` | Can be null |
| `[].expiresAt` (Required when parent is present) | `string (date-time)` | Can be null |
| `[].revokedAt` (Required when parent is present) | `string (date-time)` | Can be null |

#### 401

unauthorized

#### 403

Content type: `application/json` · `ErrorResponse`

forbidden

| Name | Type | Description |
| --- | --- | --- |
| `messageCode` (Required) | `string` |   |
| `message` | `string` |   |
| `errors` (Required) | `array of FieldError` |   |
| `errors[].field` (Required when parent is present) | `string` |   |
| `errors[].fieldValue` (Required when parent is present) | `string` |   |
| `errors[].identifier` (Required when parent is present) | `string` |   |
| `errors[].identifierValue` (Required when parent is present) | `string` |   |
| `errors[].messageCode` (Required when parent is present) | `string` |   |
| `errors[].message` | `string` |   |
| `errors[].errorType` (Required when parent is present) | `string` |   |

**Example response**

`application/json`

```json
{
  "messageCode": "string",
  "message": "string",
  "errors": [
    {}
  ]
}
```

#### 500

Content type: `application/json` · `ErrorResponse`

internalServerError

Same fields as [Get the signed-in user's own personal access tokens (403)](https://www.subrite.no/developers/personal-access-tokens?md=true#get-api-v1-users-me-personal-access-tokens).

### Example request

```bash
curl https://api.subrite.no/api/v1/users/me/personal-access-tokens \
  --header 'Authorization: Bearer <token>'
```

### Example response

200 · `application/json`

```json
[
  {
    "id": 0,
    "name": "string",
    "maskedToken": "<maskedToken>",
    "status": "active",
    "accessLevel": "read",
    "createdAt": "2019-08-24T14:15:22Z",
    "lastUsedAt": "2019-08-24T14:15:22Z",
    "expiresAt": "2019-08-24T14:15:22Z",
    "revokedAt": "2019-08-24T14:15:22Z"
  }
]
```

<a id="post-api-v1-users-me-personal-access-tokens"></a>
## Create a personal access token. The token value is returned only in this response.

`POST /api/v1/users/me/personal-access-tokens`

**Authentication:** Bearer token (JWT)

### Request body

Content type: `application/json` · Required · `CreatePersonalAccessTokenRequestDto`

| Name | Type | Description |
| --- | --- | --- |
| `name` (Required) | `string` | Identifies where the token is used, e.g. the MCP client name. · `maxLength`: `255` |
| `expiresAt` | `string (date-time)` | When the token stops working. Omit for a token that never expires. |
| `accessLevel` (Required) | `PersonalAccessTokenAccessLevel` | How much of your access the token may use. Never widens your own permissions — it only narrows them, so a 'both' token still cannot do what your role does not grant. · Allowed values: `"read"`, `"write"`, `"both"` |

**Example request body**

`application/json`

```json
{
  "name": "string",
  "expiresAt": "2019-08-24T14:15:22Z",
  "accessLevel": "read"
}
```

### Responses

#### 201

Content type: `application/json` · `CreatePersonalAccessTokenResponseDto`

| Name | Type | Description |
| --- | --- | --- |
| `id` (Required) | `number` |   |
| `name` (Required) | `string` |   |
| `maskedToken` (Required) | `string` | Masked token, e.g. sbr\_pat\_7f4c…a91d |
| `status` (Required) | `PersonalAccessTokenStatus` | Allowed values: `"active"`, `"revoked"`, `"expired"` |
| `accessLevel` (Required) | `PersonalAccessTokenAccessLevel` | Allowed values: `"read"`, `"write"`, `"both"` |
| `createdAt` (Required) | `string (date-time)` |   |
| `lastUsedAt` (Required) | `string (date-time)` | Can be null |
| `expiresAt` (Required) | `string (date-time)` | Can be null |
| `revokedAt` (Required) | `string (date-time)` | Can be null |
| `token` (Required) | `string` | The token value. Shown only in this response and never retrievable again. |

#### 401

unauthorized

#### 403

Content type: `application/json` · `ErrorResponse`

forbidden

Same fields as [Get the signed-in user's own personal access tokens (403)](https://www.subrite.no/developers/personal-access-tokens?md=true#get-api-v1-users-me-personal-access-tokens).

**Example response**

`application/json`

```json
{
  "messageCode": "string",
  "message": "string",
  "errors": [
    {}
  ]
}
```

#### 500

Content type: `application/json` · `ErrorResponse`

internalServerError

Same fields as [Get the signed-in user's own personal access tokens (403)](https://www.subrite.no/developers/personal-access-tokens?md=true#get-api-v1-users-me-personal-access-tokens).

### Example request

```bash
curl https://api.subrite.no/api/v1/users/me/personal-access-tokens \
  --request POST \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{
  "name": "string",
  "expiresAt": "2019-08-24T14:15:22Z",
  "accessLevel": "read"
}'
```

### Example response

201 · `application/json`

```json
{
  "id": 0,
  "name": "string",
  "maskedToken": "<maskedToken>",
  "status": "active",
  "accessLevel": "read",
  "createdAt": "2019-08-24T14:15:22Z",
  "lastUsedAt": "2019-08-24T14:15:22Z",
  "expiresAt": "2019-08-24T14:15:22Z",
  "revokedAt": "2019-08-24T14:15:22Z",
  "token": "<token>"
}
```

<a id="post-api-v1-users-me-personal-access-tokens-id-revoke"></a>
## Revoke a personal access token. It stays listed until deleted.

`POST /api/v1/users/me/personal-access-tokens/{id}/revoke`

**Authentication:** Bearer token (JWT)

### Parameters

| Name | In | Type | Description |
| --- | --- | --- | --- |
| `id` (Required) | path | `number` |   |

### Responses

#### 201

Content type: `application/json` · `PersonalAccessTokenResponseDto`

| Name | Type | Description |
| --- | --- | --- |
| `id` (Required) | `number` |   |
| `name` (Required) | `string` |   |
| `maskedToken` (Required) | `string` | Masked token, e.g. sbr\_pat\_7f4c…a91d |
| `status` (Required) | `PersonalAccessTokenStatus` | Allowed values: `"active"`, `"revoked"`, `"expired"` |
| `accessLevel` (Required) | `PersonalAccessTokenAccessLevel` | Allowed values: `"read"`, `"write"`, `"both"` |
| `createdAt` (Required) | `string (date-time)` |   |
| `lastUsedAt` (Required) | `string (date-time)` | Can be null |
| `expiresAt` (Required) | `string (date-time)` | Can be null |
| `revokedAt` (Required) | `string (date-time)` | Can be null |

#### 401

unauthorized

#### 403

Content type: `application/json` · `ErrorResponse`

forbidden

Same fields as [Get the signed-in user's own personal access tokens (403)](https://www.subrite.no/developers/personal-access-tokens?md=true#get-api-v1-users-me-personal-access-tokens).

**Example response**

`application/json`

```json
{
  "messageCode": "string",
  "message": "string",
  "errors": [
    {}
  ]
}
```

#### 404

Content type: `application/json` · `ErrorResponse`

personalAccessTokenNotFound

Same fields as [Get the signed-in user's own personal access tokens (403)](https://www.subrite.no/developers/personal-access-tokens?md=true#get-api-v1-users-me-personal-access-tokens).

#### 500

Content type: `application/json` · `ErrorResponse`

internalServerError

Same fields as [Get the signed-in user's own personal access tokens (403)](https://www.subrite.no/developers/personal-access-tokens?md=true#get-api-v1-users-me-personal-access-tokens).

### Example request

```bash
curl 'https://api.subrite.no/api/v1/users/me/personal-access-tokens/{id}/revoke' \
  --request POST \
  --header 'Authorization: Bearer <token>'
```

### Example response

201 · `application/json`

```json
{
  "id": 0,
  "name": "string",
  "maskedToken": "<maskedToken>",
  "status": "active",
  "accessLevel": "read",
  "createdAt": "2019-08-24T14:15:22Z",
  "lastUsedAt": "2019-08-24T14:15:22Z",
  "expiresAt": "2019-08-24T14:15:22Z",
  "revokedAt": "2019-08-24T14:15:22Z"
}
```

<a id="delete-api-v1-users-me-personal-access-tokens-id"></a>
## Delete a personal access token

`DELETE /api/v1/users/me/personal-access-tokens/{id}`

**Authentication:** Bearer token (JWT)

### Parameters

| Name | In | Type | Description |
| --- | --- | --- | --- |
| `id` (Required) | path | `number` |   |

### Responses

#### 204

#### 401

unauthorized

#### 403

Content type: `application/json` · `ErrorResponse`

forbidden

Same fields as [Get the signed-in user's own personal access tokens (403)](https://www.subrite.no/developers/personal-access-tokens?md=true#get-api-v1-users-me-personal-access-tokens).

**Example response**

`application/json`

```json
{
  "messageCode": "string",
  "message": "string",
  "errors": [
    {}
  ]
}
```

#### 404

Content type: `application/json` · `ErrorResponse`

personalAccessTokenNotFound

Same fields as [Get the signed-in user's own personal access tokens (403)](https://www.subrite.no/developers/personal-access-tokens?md=true#get-api-v1-users-me-personal-access-tokens).

#### 500

Content type: `application/json` · `ErrorResponse`

internalServerError

Same fields as [Get the signed-in user's own personal access tokens (403)](https://www.subrite.no/developers/personal-access-tokens?md=true#get-api-v1-users-me-personal-access-tokens).

### Example request

```bash
curl 'https://api.subrite.no/api/v1/users/me/personal-access-tokens/{id}' \
  --request DELETE \
  --header 'Authorization: Bearer <token>'
```