Listar Información de Tokens

Visión General

Este endpoint recupera una lista paginada de todos los tokens OAuth emitidos para la entidad. Incluye metadatos como roles, alcances (scopes), tiempos de expiración y fechas de creación. Es útil para auditorías, monitoreo de sesiones activas y gestión del ciclo de vida de los tokens.

Detalles del Endpoint

Parámetro	Descripción
Endpoint	https://api.paas.sandbox.co.passportfintech.com/v1/iam/oauth/tokens
Método	GET
Encabezados	Accept-Language, Content-Length, Content-Type: application/json, Authorization
Autenticación	Token de Acceso (Bearer Token)

Parámetros de Consulta

Parámetros de Paginación

Parámetro	Descripción
page_params.page_size	Cantidad de registros a retornar por página.
page_params.page_number	Número de página a consultar.
page_params.first_request_timestamp.seconds	Segundos UTC desde Unix epoch (`1970-01-01T00:00:00Z`). Debe estar entre `0001-01-01T00:00:00Z` y `9999-12-31T23:59:59Z` (inclusive).
page_params.first_request_timestamp.nanos	Fracción en nanosegundos (0 a 999,999,999). Debe ser un valor no negativo y representa la fracción de segundo con resolución de nanosegundos.

Parámetros de Ordenamiento

Parámetro	Descripción
order_params.order_key	Campo utilizado para ordenar los resultados.
order_params.order_direction	Dirección del ordenamiento. Valores permitidos: `ORDER_DIRECTION_ENUM_UNSPECIFIED`, `ASC`, `DESC`.

Filtros de Tokens

Parámetro	Descripción
account_id	Filtra por la referencia única de la cuenta asociada al token de acceso.
user_id	Filtra por la referencia única del usuario asociada al token de acceso.
grant_flow	Filtra por el flujo de autorización utilizado para generar el token de acceso. Valores permitidos: `GRANT_FLOW_CLIENT_CREDENTIALS`, `GRANT_FLOW_PASSWORD`, `GRANT_FLOW_ENTITY_SETUP`, `GRANT_FLOW_LOGIN`.
role	Filtra por el rol asociado al token de acceso.

Cuerpo de la Solicitud

Este endpoint no requiere un cuerpo de solicitud (request body).

Ejemplo de Solicitud

curl --location 'https://api.paas.sandbox.co.passportfintech.com/v1/iam/oauth/tokens' \ --header 'Authorization: Bearer <YOUR_ACCESS_TOKEN>' \

Cuerpo de la Respuesta

Código HTTP: 200 OK

Ejemplo de Respuesta

{ "pagination_info": { "current_page": 1, "total_pages": 1, "total_elements": 7 }, "tokens": [ { "scopes": [ "iam.user_invitations.v2.patch", "iam.client_credentials.list.get", "paas.core.breb_recipients.post", "iam.users.roles.revoke.post", "paas.core.webhooks.get", "paas.core.qrcodes.get", "paas.core.webhooks.patch", "iam.policies.get", "paas.core.account_keys.list.get", "iam.password_policies.get", "paas.core.entity_customers.post", "paas.core.entity_customers.get", "iam.users.post", "iam.accounts.get", "iam.logout.post", "iam.roles.users.list.get", "iam.mfa.*", "iam.user_invitations.v2.post", "paas.core.webhooks.list.get", "iam.users.get", "iam.users.list.get", "iam.roles.list.get", "paas.core.accounts.post", "paas.core.breb_payments.post", "iam.policies.list.get", "paas.core.breb_recipients.list.get", "paas.core.breb_payments.list.get", "paas.core.entity_customers.list.get", "iam.password_policies.list.get", "iam.client_credentials.get", "iam.users.patch", "paas.core.accounts.list.get", "iam.login_profiles.patch", "paas.core.breb_recipients.get", "paas.core.accounts.get", "paas.core.breb_payments.get", "iam.users.roles.list.get", "iam.roles.get", "iam.users.roles.grant.post", "paas.core.entity_customers.patch", "paas.core.webhooks.post", "paas.core.account_keys.post", "iam.oauth.tokens.list.get", "iam.oauth.tokens.get", "iam.users.delete", "paas.core.account_keys.get", "iam.accounts.team_size.patch", "paas.core.qrcodes.list.get", "paas.core.qrcodes.post", "paas.core.webhooks.delete", "iam.password_policies.post", "paas.core.account_keys.patch", "iam.oauth.tokens.delete", "iam.client_credentials.post" ], "token_id": "43290d06-5954-4a23-b384-9f1a5bef699c", "access_token_revoked_at": "2025-09-10T21:54:44.642Z", "roles": [ "entity.admin" ], "created_at": "2025-09-10T16:41:57.768Z", "expires_in": 86400, "token_type": "Bearer" }, { "scopes": [ "iam.accounts.get", "iam.users.get", "iam.users.list.get", "iam.login_profiles.patch", "iam.oauth.tokens.list.get", "iam.oauth.tokens.get", "iam.oauth.tokens.delete", "iam.logout.post", "iam.mfa.*", "iam.roles.get", "iam.roles.list.get", "iam.roles.users.list.get", "iam.users.roles.list.get", "paas.core.entity_customers.post", "paas.core.entity_customers.patch", "paas.core.entity_customers.get", "paas.core.entity_customers.list.get", "paas.core.accounts.post", "paas.core.accounts.get", "paas.core.accounts.list.get", "paas.core.account_keys.post", "paas.core.account_keys.get", "paas.core.account_keys.list.get", "paas.core.breb_recipients.post", "paas.core.breb_recipients.get", "paas.core.breb_recipients.list.get", "paas.core.breb_payments.post", "paas.core.breb_payments.get", "paas.core.breb_payments.list.get", "paas.core.webhooks.post", "paas.core.webhooks.get", "paas.core.webhooks.list.get", "paas.core.webhooks.patch", "paas.core.webhooks.delete", "paas.core.qrcodes.post", "paas.core.qrcodes.get", "paas.core.qrcodes.list.get", "paas.core.account_keys.patch" ], "token_id": "90f35604-9f74-48cf-994e-e9e6423a4319", "roles": [ "entity.client_credentials" ], "created_at": "2025-09-10T16:42:34.730Z", "expires_in": 86400, "token_type": "Bearer" }, { "scopes": [ "paas.core.entity.post" ], "token_id": "05faacfe-ed75-4d62-bc8a-473adf497de1", "roles": [ "entity.admin" ], "created_at": "2025-09-10T16:41:50.762Z", "expires_in": 86400, "token_type": "Bearer" }, { "scopes": [ "iam.mfa.resend_sms.post", "iam.mfa.v2.verify.post", "iam.mfa.verify_setup.post", "iam.mfa.v2.verify_setup.post", "iam.mfa.verify.post", "iam.mfa.v2.setup_sms.post", "iam.mfa.v2.resend_sms.post", "iam.mfa.setup_sms.post" ], "token_id": "56f108b2-5366-49a7-b900-cf559e9d7d1d", "roles": [ "entity.admin" ], "created_at": "2025-09-10T16:41:30.434Z", "expires_in": 600, "token_type": "Bearer" }, { "scopes": [ "iam.accounts.get", "iam.users.get", "iam.users.list.get", "iam.login_profiles.patch", "iam.oauth.tokens.list.get", "iam.oauth.tokens.get", "iam.oauth.tokens.delete", "iam.logout.post", "iam.mfa.*", "iam.roles.get", "iam.roles.list.get", "iam.roles.users.list.get", "iam.users.roles.list.get", "paas.core.entity_customers.post", "paas.core.entity_customers.patch", "paas.core.entity_customers.get", "paas.core.entity_customers.list.get", "paas.core.accounts.post", "paas.core.accounts.get", "paas.core.accounts.list.get", "paas.core.account_keys.post", "paas.core.account_keys.get", "paas.core.account_keys.list.get", "paas.core.breb_recipients.post", "paas.core.breb_recipients.get", "paas.core.breb_recipients.list.get", "paas.core.breb_payments.post", "paas.core.breb_payments.get", "paas.core.breb_payments.list.get", "paas.core.webhooks.post", "paas.core.webhooks.get", "paas.core.webhooks.list.get", "paas.core.webhooks.patch", "paas.core.webhooks.delete", "paas.core.qrcodes.post", "paas.core.qrcodes.get", "paas.core.qrcodes.list.get", "paas.core.account_keys.patch" ], "token_id": "034e0826-bd89-4de4-918c-df25b4d5e04a", "roles": [ "entity.client_credentials" ], "created_at": "2025-09-10T21:58:30.358Z", "expires_in": 86400, "token_type": "Bearer" }, { "scopes": [ "iam.accounts.get", "iam.users.get", "iam.users.list.get", "iam.login_profiles.patch", "iam.oauth.tokens.list.get", "iam.oauth.tokens.get", "iam.oauth.tokens.delete", "iam.logout.post", "iam.mfa.*", "iam.roles.get", "iam.roles.list.get", "iam.roles.users.list.get", "iam.users.roles.list.get", "paas.core.entity_customers.post", "paas.core.entity_customers.patch", "paas.core.entity_customers.get", "paas.core.entity_customers.list.get", "paas.core.accounts.post", "paas.core.accounts.get", "paas.core.accounts.list.get", "paas.core.account_keys.post", "paas.core.account_keys.get", "paas.core.account_keys.list.get", "paas.core.breb_recipients.post", "paas.core.breb_recipients.get", "paas.core.breb_recipients.list.get", "paas.core.breb_payments.post", "paas.core.breb_payments.get", "paas.core.breb_payments.list.get", "paas.core.webhooks.post", "paas.core.webhooks.get", "paas.core.webhooks.list.get", "paas.core.webhooks.patch", "paas.core.webhooks.delete", "paas.core.qrcodes.post", "paas.core.qrcodes.get", "paas.core.qrcodes.list.get", "paas.core.account_keys.patch" ], "token_id": "a6d4f09b-0900-438e-b1c9-46f34656c2ba", "access_token_revoked_at": "2025-09-10T22:22:44.451Z", "roles": [ "entity.client_credentials" ], "created_at": "2025-09-10T22:19:47.840Z", "expires_in": 86400, "token_type": "Bearer" }, { "scopes": [ "iam.accounts.get", "iam.users.get", "iam.users.list.get", "iam.login_profiles.patch", "iam.oauth.tokens.list.get", "iam.oauth.tokens.get", "iam.oauth.tokens.delete", "iam.logout.post", "iam.mfa.*", "iam.roles.get", "iam.roles.list.get", "iam.roles.users.list.get", "iam.users.roles.list.get", "paas.core.entity_customers.post", "paas.core.entity_customers.patch", "paas.core.entity_customers.get", "paas.core.entity_customers.list.get", "paas.core.accounts.post", "paas.core.accounts.get", "paas.core.accounts.list.get", "paas.core.account_keys.post", "paas.core.account_keys.get", "paas.core.account_keys.list.get", "paas.core.breb_recipients.post", "paas.core.breb_recipients.get", "paas.core.breb_recipients.list.get", "paas.core.breb_payments.post", "paas.core.breb_payments.get", "paas.core.breb_payments.list.get", "paas.core.webhooks.post", "paas.core.webhooks.get", "paas.core.webhooks.list.get", "paas.core.webhooks.patch", "paas.core.webhooks.delete", "paas.core.qrcodes.post", "paas.core.qrcodes.get", "paas.core.qrcodes.list.get", "paas.core.account_keys.patch" ], "token_id": "249a0a2e-028a-4e15-a841-de9fd4e4cd84", "roles": [ "entity.client_credentials" ], "created_at": "2025-09-10T22:22:50.337Z", "expires_in": 86400, "token_type": "Bearer" } ] }

Errores Comunes y Manejo

Código HTTP	Significado	Descripción
400	Bad Request	Parámetros de consulta inválidos o solicitud malformada.
401	Unauthorized	Token Bearer ausente, vencido o sin el alcance `iam.oauth.tokens.list.get`.
403	Forbidden	El usuario autenticado no tiene permiso para ver la lista de tokens.
500	Internal Server Error	Error inesperado. Reintente o contacte soporte si el problema persiste.

Buenas Prácticas

Usa el objeto pagination_info para iterar todas las páginas al recuperar tokens.
Audita periódicamente los tokens activos para cumplir con las políticas de seguridad.
Revoca inmediatamente tokens comprometidos o sin uso mediante el endpoint de Revocar Token.
Nunca expongas tokens sin procesar en logs o aplicaciones del lado del cliente.
Utiliza roles y scopes para aplicar modelos de acceso de mínimo privilegio.

Última actualización el