---
title: "Get all OAuth access tokens for a given OAuth app."
method: GET
path: "/v1/core/oauth/apps/{clientId}/access-token"
---

# Get all OAuth access tokens for a given OAuth app.

`GET /v1/core/oauth/apps/{clientId}/access-token`

This endpoint returns all OAuth access tokens for a given OAuth app.

## Path parameters

- `clientId` string, required — The OAuth app that the tokens are bound to.

## Query parameters

- `owner` string, required — The id of the user that created one or more OAuth access tokens.
- `fromDate` string, date-time — Return OAuth access tokens created after this date.
- `toDate` string, date-time — Return OAuth access tokens created before this date.
- `limit` integer — The number of results to return. If omitted, 100 results will be returned.
- `cursor` string — The cursor to paginate the results. Cursor-based pagination will always be used unless if left blank and a page number is provided.
- `page` integer — The page number to return. If omitted, the first page of results will be returned.
- `sortField` 'dateCreated' | 'dateUpdated' — The field to sort the results by. If omitted, the results will be sorted by dateCreated in descending order.
- `sortDirection` 'asc' | 'desc' — The direction to sort the results by. If omitted, the results will be sorted by dateCreated in descending order.

## Response `200`

Get all OAuth access tokens for a given OAuth app.

- object
  - `data` object[], required
    - `accessTokenId` string, required — The ID of the OAuth access token.
    - `oAuthAppId` string, required — The OAuth app that this token is bound to.
    - `userId` string, required — The user that this token is bound to. This is also the subject of the token.
    - `audience` string, required — The intended audience of the token.
    - `subject` string, required — The subject of the token.
    - `scope` 'read' | 'write', required — One of ("read", "write"). This will restrict what HTTP verbs the token has access to.
    - `expiresAt` string, date-time, required — The expiration date of the token.
    - `createdAt` string, date-time, required — The creation date of the token.
    - `updatedAt` string, date-time, required — The last update date of the token.
    - `revokedAt` string, date-time, nullable, required — The date the token was revoked
  - `cursor` union
    - string
    - number
    - unknown
  - `pageSize` number
  - `limit` number
  - `total` number, nullable
  - `hasNextPage` boolean

## Other responses

- `400` — Bad Request - Invalid parameters
- `401` — Unauthorized - User not authenticated
- `403` — Forbidden - User does not have access
- `404` — Not Found - Resource not found
- `422` — Unprocessable Content - The request failed validation checks
- `500` — Internal Server Error

---

[API](https://skmtc.net/siro/apis/swagger-api.md) · [All operations](https://skmtc.net/siro/apis/swagger-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/siro/swagger-api/versions/9995339a94c6/schema)