Documentation sections

Admin API: API tokens

Two Admin API methods for tokens: get the list and revoke a token by ID. A new token is created only in the panel.

Through the API you can view the list of tokens and revoke a token. You cannot create a token through the API: a new token is issued only in the panel, on the Settings → API («Настройки → API») tab. Working with tokens in the panel is described on the API tokens page. Both methods require a token with Full access («Полный доступ») (full). Authorization is described on the Admin API: overview and authorization page, and the response and error format on the Request, response and error format page.

Token object

The list returns each token in this form:

Field	Type	Description
`id`	string, UUID	Token ID. It goes into the address when you revoke the token
`name`	string	Name
`prefix`	string	The first 12 characters of the token and an ellipsis, for example `trk_01234567…`
`scopes`	array of strings	Access type, one value: `reports:read`, `spend:write`, `mcp:read` or `full`. What each one allows is described in the Access types section
`expires_at`	string, RFC 3339 date	End of the validity period. A token without an expiration has no such field
`last_used_at`	string, RFC 3339 date	Time of the last request with this token. Until the token has been used, there is no such field
`created_at`	string, RFC 3339 date	Creation time
`created_by`	string, UUID	ID of the user who created the token. Requests run on their behalf
`created_by_email`	string	Email of this user

The token value itself is not included in the object. It is shown only once — in the panel, right after creation.

Methods

List tokens

http

GET /api/v1/api-tokens

Returns all of the team's tokens, including expired ones and those created by other users.

Token scope: full. There are no path, query or body parameters. There is no pagination and no filters.

Response — code 200 and an array of token objects. The newest come first. If there are no tokens, you get an empty array [].

An expired token stays in the list until it is revoked. You can tell it by expires_at: the date is in the past.

Example request:

bash

curl https://panel.example.com/api/v1/api-tokens \
  -H "Api-Key: <token>"

Example response:

json

[
  {
    "scopes": ["reports:read"],
    "expires_at": "2027-01-02T10:15:00Z",
    "id": "3f2b8c1e-5a47-4d1b-9c0e-7a6d2f4b8e10",
    "name": "BI reports",
    "prefix": "trk_01234567…",
    "last_used_at": "2026-10-04T08:41:12.305118Z",
    "created_at": "2026-10-04T10:15:00.114207Z",
    "created_by": "9d1e4c70-2b3a-4f5d-8e6c-0a1b2c3d4e5f",
    "created_by_email": "[email protected]"
  }
]

Create a token

http

POST /api/v1/api-tokens

The method is not available with the Api-Key header: any token, including Full access, gets code 403.

json

{"code": "token_scope", "message": "API token scope does not allow this action"}

A new token is created in the panel, on the Settings → API tab — see Creating a token. That is also where you set the name, access type and expiration. You cannot change them on an existing token: revoke the token and create a new one.

Revoke a token

http

DELETE /api/v1/api-tokens/{id}

Deletes the token. Requests with it immediately start getting 401.

Token scope: full. There is no request body.

Parameter	Where	Type	Required	Description
`id`	path	string, UUID	yes	The `id` value from the token list

Response — code 204 with no body.

Errors:

Code	`code`	`message`	When
`404`	`not_found`	`resource not found`	There is no token with this ID: the ID is wrong or the token was already revoked
`400`	`bad_request`	`некорректный идентификатор или значение` (invalid ID or value)	`id` is not in UUID format

Example request:

bash

curl -X DELETE https://panel.example.com/api/v1/api-tokens/3f2b8c1e-5a47-4d1b-9c0e-7a6d2f4b8e10 \
  -H "Api-Key: <token>"

Limits

You can revoke any token of the team, including the one the request was sent with. After that, the next request with it gets 401.
A revoked token cannot be restored. A repeated request with the same ID responds 404.
There are no methods to create, change or extend a token. To replace the token in an integration, create a new one in the panel, put it into the integration and revoke the old one.
A user's tokens are deleted together with the user, and also when their role becomes lower than admin — see Who the token acts as.
When the license is inactive, both methods respond 402 — see Expired license.

Updated October 13, 2026Need help? ↗