Developer and workspace tokens

Developer access tokens authenticate management API calls in X-Developer-Token. Workspace API tokens are a separate credential and do not replace developer tokens or registration API keys. See credential selection.

API conventions · All endpoints · Schemas

/e/v1/developer/tokens/

Manage workspace API tokens (separate from developer access tokens).

Authentication: X-Developer-Token with the scope shown below, an active SyAuth plan, and access to the resource. Dashboard requests use your signed-in account.

GET

Required developer-token scope: read_tokens.

Optional list filters workspace_id and oauth_client where shown below; detail routes check resource ownership.

Request / response schema: ApiToken.

Request fields (combine with the requirements and schema above):

Location	Field	Fallback when absent
query	oauth_client	not supplied
query	workspace_id	not supplied

Related schemas: ApiToken.

Success and error response examples

Illustrative values; conditional branches are alternatives. Fields vary with the operation and account configuration.

200 — json

[
  {
    "id": "11111111-1111-4111-8111-111111111111",
    "name": "Example",
    "token": "EXAMPLE_TOKEN",
    "scope": "EXAMPLE_SCOPE",
    "created_at": "2026-10-26T12:00:00Z",
    "expires_at": "2026-10-26T12:00:00Z",
    "last_used_at": "2026-10-26T12:00:00Z",
    "is_active": true,
    "created_via_api_key": "EXAMPLE_CREATED_VIA_API_KEY",
    "developer_id": "EXAMPLE_DEVELOPER_ID",
    "workspace": "11111111-1111-4111-8111-111111111111"
  }
]

403 — json

{
  "error": "Workspace not found or access denied"
}

404 — json

{
  "error": "Workspace not found"
}

POST

Required developer-token scope: write_tokens.

Supply workspace explicitly and the required fields in the linked schema. Plan features, quotas and resource ownership apply.

Request / response schema: ApiToken.

Request fields (combine with the requirements and schema above):

Location	Field	Fallback when absent
query	user_plan_id	not supplied
body	workspace	not supplied

Related schemas: ApiToken.

Example request body:

{
  "name": "Application token",
  "workspace": "11111111-1111-4111-8111-111111111111",
  "scope": "read,write"
}

Success and error response examples

Illustrative values; conditional branches are alternatives. Fields vary with the operation and account configuration.

201 — json

{
  "id": "11111111-1111-4111-8111-111111111111",
  "name": "Example",
  "token": "EXAMPLE_TOKEN",
  "scope": "EXAMPLE_SCOPE",
  "created_at": "2026-10-26T12:00:00Z",
  "expires_at": "2026-10-26T12:00:00Z",
  "last_used_at": "2026-10-26T12:00:00Z",
  "is_active": true,
  "created_via_api_key": "EXAMPLE_CREATED_VIA_API_KEY",
  "developer_id": "EXAMPLE_DEVELOPER_ID",
  "workspace": "11111111-1111-4111-8111-111111111111"
}

400 — json

JSON response varies with the request. See the operation requirements and linked schema; validation errors may be keyed by field name.

403 — json

{
  "error": "You have reached the maximum number of API tokens allowed on your current plan.",
  "upgrade_message": "Please upgrade your plan to create more API tokens"
}

403 — json

{
  "error": "You do not have access to this plan"
}

/e/v1/developer/tokens/{token_id}/

Manage workspace API tokens (separate from developer access tokens).

Authentication: X-Developer-Token with the scope shown below, an active SyAuth plan, and access to the resource. Dashboard requests use your signed-in account.

GET

Required developer-token scope: read_tokens.

Optional list filters workspace_id and oauth_client where shown below; detail routes check resource ownership.

Path parameters: token_id (uuid, required).

Request / response schema: ApiToken.

Related schemas: ApiToken.

Success and error response examples

Illustrative values; conditional branches are alternatives. Fields vary with the operation and account configuration.

200 — json

{
  "id": "11111111-1111-4111-8111-111111111111",
  "name": "Example",
  "token": "EXAMPLE_TOKEN",
  "scope": "EXAMPLE_SCOPE",
  "created_at": "2026-10-26T12:00:00Z",
  "expires_at": "2026-10-26T12:00:00Z",
  "last_used_at": "2026-10-26T12:00:00Z",
  "is_active": true,
  "created_via_api_key": "EXAMPLE_CREATED_VIA_API_KEY",
  "developer_id": "EXAMPLE_DEVELOPER_ID",
  "workspace": "11111111-1111-4111-8111-111111111111"
}

PATCH

Required developer-token scope: write_tokens.

Partial update using the linked schema; resource ownership applies.

Path parameters: token_id (uuid, required).

Request / response schema: ApiToken.

Related schemas: ApiToken.

Success and error response examples

Illustrative values; conditional branches are alternatives. Fields vary with the operation and account configuration.

200 — json

{
  "id": "11111111-1111-4111-8111-111111111111",
  "name": "Example",
  "token": "EXAMPLE_TOKEN",
  "scope": "EXAMPLE_SCOPE",
  "created_at": "2026-10-26T12:00:00Z",
  "expires_at": "2026-10-26T12:00:00Z",
  "last_used_at": "2026-10-26T12:00:00Z",
  "is_active": true,
  "created_via_api_key": "EXAMPLE_CREATED_VIA_API_KEY",
  "developer_id": "EXAMPLE_DEVELOPER_ID",
  "workspace": "11111111-1111-4111-8111-111111111111"
}

400 — json

JSON response varies with the request. See the operation requirements and linked schema; validation errors may be keyed by field name.

DELETE

Required developer-token scope: write_tokens.

No body; resource ownership applies.

Path parameters: token_id (uuid, required).

Success and error response examples

Illustrative values; conditional branches are alternatives. Fields vary with the operation and account configuration.

204 — json

No response body.

/e/v1/developer/access-tokens/

List scoped developer tokens or create a token shown once.

Authentication: X-Developer-Token with the scope shown below, an active SyAuth plan, and access to the resource. Dashboard requests use your signed-in account.

GET

Required developer-token scope: read_access_tokens.

No body. Returns tokens, count and available_scopes. Use available_scopes to discover accepted scope names.

Related schemas: DeveloperAccessToken.

Success and error response examples

Illustrative values; conditional branches are alternatives. Fields vary with the operation and account configuration.

200 — json

{
  "tokens": [
    {
      "id": "11111111-1111-4111-8111-111111111111",
      "name": "Example",
      "scopes_display": [],
      "token_prefix_display": "EXAMPLE_TOKEN_PREFIX_DISPLAY",
      "expires_at": "2026-10-26T12:00:00Z",
      "last_used_at": "2026-10-26T12:00:00Z",
      "last_used_ip": "EXAMPLE_LAST_USED_IP",
      "created_at": "2026-10-26T12:00:00Z",
      "is_active": true,
      "is_expired": true
    }
  ],
  "available_scopes": [
    {
      "value": "EXAMPLE_VALUE",
      "label": "EXAMPLE_LABEL"
    }
  ],
  "count": 1
}

POST

Required developer-token scope: write_access_tokens.

Required JSON name and scopes array of accepted names; optional expires_in_days integer 1..365 or null. Name must be unique among this developer’s active tokens.

Request / response schema: DeveloperAccessToken.

Related schemas: DeveloperAccessToken.

Example request body:

{
  "name": "My application",
  "scopes": [
    "read_workspaces",
    "write_workspaces"
  ],
  "expires_in_days": 7
}

Success and error response examples

Illustrative values; conditional branches are alternatives. Fields vary with the operation and account configuration.

201 — json

{
  "id": "11111111-1111-4111-8111-111111111111",
  "name": "Example",
  "scopes_display": [],
  "token_prefix_display": "EXAMPLE_TOKEN_PREFIX_DISPLAY",
  "expires_at": "2026-10-26T12:00:00Z",
  "last_used_at": "2026-10-26T12:00:00Z",
  "last_used_ip": "EXAMPLE_LAST_USED_IP",
  "created_at": "2026-10-26T12:00:00Z",
  "is_active": true,
  "is_expired": true
}

400 — json

{
  "error": "Invalid data",
  "details": "EXAMPLE_DETAILS"
}

/e/v1/developer/access-tokens/{token_id}/

Read metadata or remove/revoke a developer token.

Authentication: X-Developer-Token with the scope shown below, an active SyAuth plan, and access to the resource. Dashboard requests use your signed-in account.

GET

Required developer-token scope: read_access_tokens.

No body; only the owning developer can access it. Plaintext token is not returned.

Path parameters: token_id (uuid, required).

Related schemas: DeveloperAccessToken.

Success and error response examples

Illustrative values; conditional branches are alternatives. Fields vary with the operation and account configuration.

200 — json

{
  "id": "11111111-1111-4111-8111-111111111111",
  "name": "Example",
  "scopes_display": [],
  "token_prefix_display": "EXAMPLE_TOKEN_PREFIX_DISPLAY",
  "expires_at": "2026-10-26T12:00:00Z",
  "last_used_at": "2026-10-26T12:00:00Z",
  "last_used_ip": "EXAMPLE_LAST_USED_IP",
  "created_at": "2026-10-26T12:00:00Z",
  "is_active": true,
  "is_expired": true
}

404 — json

{
  "error": "Token not found"
}

DELETE

Required developer-token scope: write_access_tokens.

No body. Returns 200 with a revocation message, not 204.

Path parameters: token_id (uuid, required).

Success and error response examples

Illustrative values; conditional branches are alternatives. Fields vary with the operation and account configuration.

200 — json

{
  "message": "Token \"EXAMPLE\" has been revoked"
}

404 — json

{
  "error": "Token not found"
}

/e/v1/developer/access-tokens/{token_id}/revoke/

Explicitly revoke a developer token.

Authentication: X-Developer-Token with the scope shown below, an active SyAuth plan, and access to the resource. Dashboard requests use your signed-in account.

POST

Required developer-token scope: write_access_tokens.

No body. Already-revoked token returns 400; inaccessible/not found token returns 404.

Path parameters: token_id (uuid, required).

Success and error response examples

Illustrative values; conditional branches are alternatives. Fields vary with the operation and account configuration.

200 — json

{
  "message": "Token \"EXAMPLE\" has been revoked"
}

400 — json

{
  "error": "Token is already revoked"
}

404 — json

{
  "error": "Token not found"
}