---
title: "Admin: list every active personal access token in the org"
method: GET
path: "/personal-access-tokens/admin"
tags: ["Personal Access Tokens"]
---

# Admin: list every active personal access token in the org

`GET /personal-access-tokens/admin`

Lists every active personal access token across every member of the
org, paginated, with each token's owner attached (including owners
who've since been deleted from the org — see `ownerDeleted` on
`AdminPatListItem`). For incident response: a departed employee or a
compromised laptop, where only the token's own creator could
otherwise see or revoke it.

Requires org-admin privileges (`userAdminCheck`) — note this returns
**`400`**, not `403`, for a non-admin caller (shared middleware
behavior across the codebase, not specific to this route).

## Query parameters

- `page` integer
- `limit` integer

## Response `200`

Every active personal access token in the org

- AdminPatListResponse — Response body for `GET /personal-access-tokens/admin` (`adminListTokens`). Paginated — unlike the self-service `ListPatResponse` — since an org can have far more active tokens than a fixed-window cap's worth.
  - `data` AdminPatListItem[], required
    - `id` string, required — Token ID
    - `name` string, required — Token name
    - `scopes` string[], required — Granted scopes
    - `createdAt` string, date-time, required
    - `expiresAt` string, date-time, required — Expiry timestamp. A `"never"`-expiry token is stored as a ~100-year-out date, not a literal null — treat anything decades out as "never" rather than a real deadline.
    - `lastUsedAt` string, date-time — Last time this token successfully authenticated a request. Throttled server-side to update at most once per 5 minutes per token; absent if the token has never been used.
    - `userId` string, required — ID of the user who created this token
    - `ownerEmail` string, email — Owner's email. Populated even when `ownerDeleted` is true (last-known value), for auditing.
    - `ownerFullName` string — Owner's full name (same last-known-value behavior as `ownerEmail`)
    - `ownerDeleted` boolean, required — True if the owning user has been removed from the org (or no longer resolves at all). The token still appears — a deleted user's tokens stop authenticating automatically, but stay visible here so an admin can audit/clean them up.
  - `pagination` object, required
    - `page` integer, required
    - `limit` integer, required — Items per page (max 100)
    - `total` integer, required
    - `totalPages` integer, required

## Other responses

- `400` — Invalid query parameters, or the caller is not an org admin
- `401` — Unauthorized
- `429` — Rate limit exceeded

---

[API](https://skmtc.net/pipeshub-ai/apis/pipeshub-api.md) · [All operations](https://skmtc.net/pipeshub-ai/apis/pipeshub-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/pipeshub-ai/pipeshub-api/revisions/64bfe76b130e/schema)