---
title: "List member access tokens"
method: GET
path: "/api/organizations/{name}/settings/tokens"
tags: ["orgs"]
---

# List member access tokens

`GET /api/organizations/{name}/settings/tokens`

List the access tokens of the organization's members. Team or Enterprise only.

## Path parameters

- `name` string, required

## Query parameters

- `cursor` string — Pagination cursor from the `Link` header
- `limit` integer
- `q` string — Filter on `owner:`, `role:`, `status:` and `token:` (last 4 characters), negatable with `-`. Pass `status:all` to include revoked tokens.

## Response `200`

Array of organization member access tokens

- object[]
  - `_id` string, required
  - `displayName` string, required — Name the owner gave the token. Provided when the organization requires administrator approval of member tokens
  - `role` 'read' | 'write' | 'fineGrained', required — Kind of access the token carries. `read` and `write` reach everything their owner can reach, while `fineGrained` is limited to the permissions listed under `fineGrained`
  - `last4` string — Last 4 characters of the token's value, the only part of it ever returned. Absent on tokens created before this was recorded
  - `createdAt` string, date-time, required — Date the token was created, or the date it was last rotated
  - `lastUsedAt` string, date-time — Date the token last authenticated a request. Absent on tokens that have never been used
  - `owner` object, required — Organization member the token belongs to
    - `_id` string, required
    - `name` string, required — Username of the member
    - `fullname` string, required
    - `avatarUrl` string, required
  - `authorization` object — Where the token stands in the organization's approval flow. Reported by organizations that require administrator approval of member tokens, and on any token whose access has been revoked
    - `status` 'pending' | 'approved' | 'revoked' | 'denied', required — `pending` while the token awaits an administrator's decision, `approved` once it may act on the organization, `denied` if an administrator refused it, and `revoked` if an administrator withdrew access it had already been granted
    - `requestedAt` string, date-time, required — Date the token first requested access to the organization
    - `authorizedAt` string, date-time — Date the token was granted access, recorded when the organization grants it automatically because the owner already holds write access
    - `authorizer` object — User who granted the token its access. Absent when `authorizedAt` is, and when that account has since been deleted
      - `name` string, required
      - `fullname` string, required
      - `avatarUrl` string, required
  - `fineGrained` object — Permissions carried by a `fineGrained` token, narrowed to those that bear on the organization. Absent on `read` and `write` tokens, whose access is not expressed as a permission list, and never covering the account-wide permissions the token may hold elsewhere
    - `scoped` object[], required — Permissions the token holds on individual entities, limited to the organization and the repositories it owns. Scopes pointing elsewhere are omitted
      - `entity` object, required — Entity the permissions apply to the organization itself, or one of its repositories
        - `_id` string, required
        - `type` 'dataset' | 'model' | 'space' | 'bucket' | 'kernel' | 'collection' | 'org' | 'user' | 'resource-group' | 'oauth-app', required
      - `permissions` string[], required — Permissions the token holds on the entity

---

[API](https://skmtc.net/huggingface/apis/hub-api-endpoints.md) · [All operations](https://skmtc.net/huggingface/apis/hub-api-endpoints/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/huggingface/hub-api-endpoints/revisions/4ea565dddd8a/schema)