List Token Information

Overview

This endpoint retrieves a paginated list of all OAuth tokens issued for the entity. It includes metadata such as roles, scopes, expiration times, and creation dates. This is useful for auditing, monitoring active sessions, and managing token lifecycle.

Endpoint Details

Definition	Description
Endpoint	https://api.paas.sandbox.co.passportfintech.com/v1/iam/oauth/tokens
Method	GET
Headers	Accept-Language, Content-Length, Content-Type: application/json, Authorization
Authentication	Access Token (Bearer Token)

Query Parameters

Pagination Parameters

Parameter	Description
page_params.page_size	Number of records to return per page.
page_params.page_number	Page number to retrieve.
page_params.first_request_timestamp.seconds	UTC seconds since Unix epoch (`1970-01-01T00:00:00Z`). Must be between `0001-01-01T00:00:00Z` and `9999-12-31T23:59:59Z` (inclusive).
page_params.first_request_timestamp.nanos	Nanosecond fraction (0 to 999,999,999). Must be a non-negative value and represents fractional seconds at nanosecond resolution.

Ordering Parameters

Parameter	Description
order_params.order_key	Field used to sort the results.
order_params.order_direction	Sort direction. Allowed values: `ORDER_DIRECTION_ENUM_UNSPECIFIED`, `ASC`, `DESC`.

Token Filters

Parameter	Description
account_id	Filters by the unique account reference associated with the access token.
user_id	Filters by the unique user reference associated with the access token.
grant_flow	Filters by the grant flow used to generate the access token. Allowed values: `GRANT_FLOW_CLIENT_CREDENTIALS`, `GRANT_FLOW_PASSWORD`, `GRANT_FLOW_ENTITY_SETUP`, `GRANT_FLOW_LOGIN`.
role	Filters by the role associated with the access token.

Request Body

This endpoint does not require a request body.

Example Request

curl --location 'https://api.paas.sandbox.co.passportfintech.com/v1/iam/oauth/tokens' \ --header 'Authorization: Bearer <YOUR_ACCESS_TOKEN>' \

Response

HTTP Status Code 200 OK.

Example of Response

{ "pagination_info": { "current_page": 1, "total_pages": 1, "total_elements": 7 }, "tokens": [ { "scopes": [ "iam.user_invitations.v2.patch", "iam.client_credentials.list.get", "paas.core.breb_recipients.post", "iam.users.roles.revoke.post", "paas.core.webhooks.get", "paas.core.qrcodes.get", "paas.core.webhooks.patch", "iam.policies.get", "paas.core.account_keys.list.get", "iam.password_policies.get", "paas.core.entity_customers.post", "paas.core.entity_customers.get", "iam.users.post", "iam.accounts.get", "iam.logout.post", "iam.roles.users.list.get", "iam.mfa.*", "iam.user_invitations.v2.post", "paas.core.webhooks.list.get", "iam.users.get", "iam.users.list.get", "iam.roles.list.get", "paas.core.accounts.post", "paas.core.breb_payments.post", "iam.policies.list.get", "paas.core.breb_recipients.list.get", "paas.core.breb_payments.list.get", "paas.core.entity_customers.list.get", "iam.password_policies.list.get", "iam.client_credentials.get", "iam.users.patch", "paas.core.accounts.list.get", "iam.login_profiles.patch", "paas.core.breb_recipients.get", "paas.core.accounts.get", "paas.core.breb_payments.get", "iam.users.roles.list.get", "iam.roles.get", "iam.users.roles.grant.post", "paas.core.entity_customers.patch", "paas.core.webhooks.post", "paas.core.account_keys.post", "iam.oauth.tokens.list.get", "iam.oauth.tokens.get", "iam.users.delete", "paas.core.account_keys.get", "iam.accounts.team_size.patch", "paas.core.qrcodes.list.get", "paas.core.qrcodes.post", "paas.core.webhooks.delete", "iam.password_policies.post", "paas.core.account_keys.patch", "iam.oauth.tokens.delete", "iam.client_credentials.post" ], "token_id": "43290d06-5954-4a23-b384-9f1a5bef699c", "access_token_revoked_at": "2025-09-10T21:54:44.642Z", "roles": [ "entity.admin" ], "created_at": "2025-09-10T16:41:57.768Z", "expires_in": 86400, "token_type": "Bearer" }, { "scopes": [ "iam.accounts.get", "iam.users.get", "iam.users.list.get", "iam.login_profiles.patch", "iam.oauth.tokens.list.get", "iam.oauth.tokens.get", "iam.oauth.tokens.delete", "iam.logout.post", "iam.mfa.*", "iam.roles.get", "iam.roles.list.get", "iam.roles.users.list.get", "iam.users.roles.list.get", "paas.core.entity_customers.post", "paas.core.entity_customers.patch", "paas.core.entity_customers.get", "paas.core.entity_customers.list.get", "paas.core.accounts.post", "paas.core.accounts.get", "paas.core.accounts.list.get", "paas.core.account_keys.post", "paas.core.account_keys.get", "paas.core.account_keys.list.get", "paas.core.breb_recipients.post", "paas.core.breb_recipients.get", "paas.core.breb_recipients.list.get", "paas.core.breb_payments.post", "paas.core.breb_payments.get", "paas.core.breb_payments.list.get", "paas.core.webhooks.post", "paas.core.webhooks.get", "paas.core.webhooks.list.get", "paas.core.webhooks.patch", "paas.core.webhooks.delete", "paas.core.qrcodes.post", "paas.core.qrcodes.get", "paas.core.qrcodes.list.get", "paas.core.account_keys.patch" ], "token_id": "90f35604-9f74-48cf-994e-e9e6423a4319", "roles": [ "entity.client_credentials" ], "created_at": "2025-09-10T16:42:34.730Z", "expires_in": 86400, "token_type": "Bearer" }, { "scopes": [ "paas.core.entity.post" ], "token_id": "05faacfe-ed75-4d62-bc8a-473adf497de1", "roles": [ "entity.admin" ], "created_at": "2025-09-10T16:41:50.762Z", "expires_in": 86400, "token_type": "Bearer" }, { "scopes": [ "iam.mfa.resend_sms.post", "iam.mfa.v2.verify.post", "iam.mfa.verify_setup.post", "iam.mfa.v2.verify_setup.post", "iam.mfa.verify.post", "iam.mfa.v2.setup_sms.post", "iam.mfa.v2.resend_sms.post", "iam.mfa.setup_sms.post" ], "token_id": "56f108b2-5366-49a7-b900-cf559e9d7d1d", "roles": [ "entity.admin" ], "created_at": "2025-09-10T16:41:30.434Z", "expires_in": 600, "token_type": "Bearer" }, { "scopes": [ "iam.accounts.get", "iam.users.get", "iam.users.list.get", "iam.login_profiles.patch", "iam.oauth.tokens.list.get", "iam.oauth.tokens.get", "iam.oauth.tokens.delete", "iam.logout.post", "iam.mfa.*", "iam.roles.get", "iam.roles.list.get", "iam.roles.users.list.get", "iam.users.roles.list.get", "paas.core.entity_customers.post", "paas.core.entity_customers.patch", "paas.core.entity_customers.get", "paas.core.entity_customers.list.get", "paas.core.accounts.post", "paas.core.accounts.get", "paas.core.accounts.list.get", "paas.core.account_keys.post", "paas.core.account_keys.get", "paas.core.account_keys.list.get", "paas.core.breb_recipients.post", "paas.core.breb_recipients.get", "paas.core.breb_recipients.list.get", "paas.core.breb_payments.post", "paas.core.breb_payments.get", "paas.core.breb_payments.list.get", "paas.core.webhooks.post", "paas.core.webhooks.get", "paas.core.webhooks.list.get", "paas.core.webhooks.patch", "paas.core.webhooks.delete", "paas.core.qrcodes.post", "paas.core.qrcodes.get", "paas.core.qrcodes.list.get", "paas.core.account_keys.patch" ], "token_id": "034e0826-bd89-4de4-918c-df25b4d5e04a", "roles": [ "entity.client_credentials" ], "created_at": "2025-09-10T21:58:30.358Z", "expires_in": 86400, "token_type": "Bearer" }, { "scopes": [ "iam.accounts.get", "iam.users.get", "iam.users.list.get", "iam.login_profiles.patch", "iam.oauth.tokens.list.get", "iam.oauth.tokens.get", "iam.oauth.tokens.delete", "iam.logout.post", "iam.mfa.*", "iam.roles.get", "iam.roles.list.get", "iam.roles.users.list.get", "iam.users.roles.list.get", "paas.core.entity_customers.post", "paas.core.entity_customers.patch", "paas.core.entity_customers.get", "paas.core.entity_customers.list.get", "paas.core.accounts.post", "paas.core.accounts.get", "paas.core.accounts.list.get", "paas.core.account_keys.post", "paas.core.account_keys.get", "paas.core.account_keys.list.get", "paas.core.breb_recipients.post", "paas.core.breb_recipients.get", "paas.core.breb_recipients.list.get", "paas.core.breb_payments.post", "paas.core.breb_payments.get", "paas.core.breb_payments.list.get", "paas.core.webhooks.post", "paas.core.webhooks.get", "paas.core.webhooks.list.get", "paas.core.webhooks.patch", "paas.core.webhooks.delete", "paas.core.qrcodes.post", "paas.core.qrcodes.get", "paas.core.qrcodes.list.get", "paas.core.account_keys.patch" ], "token_id": "a6d4f09b-0900-438e-b1c9-46f34656c2ba", "access_token_revoked_at": "2025-09-10T22:22:44.451Z", "roles": [ "entity.client_credentials" ], "created_at": "2025-09-10T22:19:47.840Z", "expires_in": 86400, "token_type": "Bearer" }, { "scopes": [ "iam.accounts.get", "iam.users.get", "iam.users.list.get", "iam.login_profiles.patch", "iam.oauth.tokens.list.get", "iam.oauth.tokens.get", "iam.oauth.tokens.delete", "iam.logout.post", "iam.mfa.*", "iam.roles.get", "iam.roles.list.get", "iam.roles.users.list.get", "iam.users.roles.list.get", "paas.core.entity_customers.post", "paas.core.entity_customers.patch", "paas.core.entity_customers.get", "paas.core.entity_customers.list.get", "paas.core.accounts.post", "paas.core.accounts.get", "paas.core.accounts.list.get", "paas.core.account_keys.post", "paas.core.account_keys.get", "paas.core.account_keys.list.get", "paas.core.breb_recipients.post", "paas.core.breb_recipients.get", "paas.core.breb_recipients.list.get", "paas.core.breb_payments.post", "paas.core.breb_payments.get", "paas.core.breb_payments.list.get", "paas.core.webhooks.post", "paas.core.webhooks.get", "paas.core.webhooks.list.get", "paas.core.webhooks.patch", "paas.core.webhooks.delete", "paas.core.qrcodes.post", "paas.core.qrcodes.get", "paas.core.qrcodes.list.get", "paas.core.account_keys.patch" ], "token_id": "249a0a2e-028a-4e15-a841-de9fd4e4cd84", "roles": [ "entity.client_credentials" ], "created_at": "2025-09-10T22:22:50.337Z", "expires_in": 86400, "token_type": "Bearer" } ] }

Common Errors and Handling

HTTP Status Code	Meaning	Description
400	Bad Request	Invalid query parameters or malformed request
401	Unauthorized	Bearer token missing, expired, or does not include `iam.oauth.tokens.list.get` scope
403	Forbidden	Authenticated user lacks permission to view token list
500	Internal Server Error	Unexpected error. Retry or contact support if issue persists

Best Practices

Use the pagination_info object to iterate through all pages when retrieving tokens.
Regularly audit active tokens to ensure compliance with security policies.
Immediately revoke compromised or unused tokens using the Revoke Token endpoint.
Never expose raw tokens in logs or client-side applications.
Use roles and scopes to enforce least-privilege access models.

Last updated on