--- title: "Get tokens" method: GET path: "/tokens" tags: ["Tokens"] --- # Get tokens `GET /tokens` The `GET /tokens` endpoint retrieves a list of all tokens for the authenticated member. ## Query parameters - `type` 'INVALID' | 'ACCESS' | 'TRANSFER' - `page.offset` string - `page.limit` integer, required - `filter.sourceAccountId` string - `filter.destinationAccountId` string - `filter.startTimeMs` string, string - `filter.endTimeMs` string, string - `filter.role` 'ANY' | 'FROM' | 'TO' | 'ISSUER' - `filter.actingAsRefId` string ## Response `200` Successful response - GetTokensResponse - `offset` string — The offset of the first item returned in the collection. - `tokens` Token[] — Contains the details of each requested token returned according to the request's filtering parameters. - `id` string — Identifies a unique authorization token for a transfer, standing order, or account information access. - `payload` union — Contains the details about the token specified by id. - object - `transfer` TransferBody — Contains the request payload for a transfer token representing a one-time payment. - `amount` string — The transaction amount with up to four digits after the decimal point. - `attachments` Attachment[] — Contains optional provider blob objects supporting the transfer/transaction. - `blobId` string — The unique numeric value that references blob data. - `name` string — The name of the attachment. This can contain any combination of characters. - `type` string — Specifies the type of attachment, e.g., image, audio, multimedia, or binary executable code. - `confirmFunds` boolean — If true, sufficient funds available for transfer are confirmed. - `currency` string, required — The ISO 4217 three letter currency code. - `executionDate` string — Specifies the execution date for the transfer (in ISO 8601 format). - `instructions` TransferInstructions, required — Contains the transfer instructions for each payment. - `metadata` Metadata — Information governing or otherwise related to the transfer instructions. - … - `source` TransferDebtorEndpoint — Contains information about the payer account. - … - `transferDestinations` TransferDestination[], required — The beneficiary account specifying the transfer destination, i.e., TPP/merchant/creditor bank account. - … - `lifetimeAmount` string, required — The total amount over the life of the token, with up to four digits after the decimal point. - `remittanceReference` string — The creditor's reference for matching an entry with the items that the transfer is intended to settle, such as commercial invoices in an accounts receivable system. - `returnRefundAccount` boolean — Requests that a refund account be returned in the response of `GET transfers` for any amounts refunded. - `actingAs` ActingAs — Specifies another party for whom the token was created 'on behalf of'. - `displayName` string — The name of the recipient shown to the user; required when specifying `actingAs`, optional otherwise. - `refId` string — The TPP-generated reference identifier for the token. This is not to be confused with the `requestId`. The `refId` maps to the `tppRefId` in the bank's `consentRequest`. This is needed to match/verify the originating token request with the bank's consent request.
We recommend that the `refId` should not contain special characters (the allowed characters are the 26-letter Latin alphabet, the numerical digits from 0-9 and the hyphen '-'). This field should not exceed 18 characters in length. - `secondaryName` string — The domain or email address of the recipient shown to the user along with the `displayName`. - `authorizationMetadata` TokenPayloadAuthorizationMetadataEntry — Bank-defined additional authorization properties. - `description` string — Description of the payment with the following qualifiers - `effectiveAtMs` string, string — Sets when the token took effect in milliseconds, 1 day (24 hours) = 8640000000, 1 hour = 36000000, and 1 minute = 60000 - `endorseUntilMs` string, string — The token can be endorsed until this time in milliseconds, 1 day (24 hours) = 8640000000, 1 hour = 36000000, and 1 minute = 60000 - `expiresAtMs` string, string — Token expiration date-time. Access tokens typically have a 90-day lifespan unless overridden by `tokenExpiration` in the original token request. For transfer tokens, this is a bank-optional expiration time. Note - Not all banks support the override of the 90-day default - `from` TokenMember — Contains information identifying the Token.io member. - `alias` Alias — Alternate or additional member identification information. - `realmId` string — Identifies a member created under the realm of a specific bank. - `type` 'INVALID' | 'UNKNOWN' | 'EMAIL' | 'PHONE' | 'DOMAIN' | 'BANK' | 'CUSTOM' | 'EIDAS' — The types of alias available. - `value` string — The alias string representing the type. - `id` string, required — The Token.io-assigned `memberId` of the TPP. - `initiatorId` string — The `memberId` of the member that requested the token creation. - `issuer` TokenMember — Contains information identifying the Token.io member. - `alias` Alias — Alternate or additional member identification information. - `realmId` string — Identifies a member created under the realm of a specific bank. - `type` 'INVALID' | 'UNKNOWN' | 'EMAIL' | 'PHONE' | 'DOMAIN' | 'BANK' | 'CUSTOM' | 'EIDAS' — The types of alias available. - `value` string — The alias string representing the type. - `id` string, required — The Token.io-assigned `memberId` of the TPP. - `receiptRequested` boolean — Indicates whether the TPP requested an email confirmation of the token request be sent to the user. - `refId` string — The TPP-generated reference identifier for the token. This is not to be confused with the `requestId`. The `refId` maps to the `tppRefId` in the bank's `consentRequest`. This is needed to match/verify the originating token request with the bank's consent request.
We recommend that the `refId` should not contain special characters (the allowed characters are the 26-letter Latin alphabet, the numerical digits from 0-9 and the hyphen '-'). This field should not exceed 18 characters in length. - `to` TokenMember — Contains information identifying the Token.io member. - `alias` Alias — Alternate or additional member identification information. - `realmId` string — Identifies a member created under the realm of a specific bank. - `type` 'INVALID' | 'UNKNOWN' | 'EMAIL' | 'PHONE' | 'DOMAIN' | 'BANK' | 'CUSTOM' | 'EIDAS' — The types of alias available. - `value` string — The alias string representing the type. - `id` string, required — The Token.io-assigned `memberId` of the TPP. - `tokenRequestId` string — Identifies the original token request. The value returned in the response to the original token request as the id. - `version` string — Token.io API version number - object - `standingOrder` StandingOrderBody — Contains the request payload for a token representing a standing order/recurring payment. - `amount` string, required — Specifies the transaction amount, with up to four digits after the decimal point, for payments scheduled according to frequency. - `currency` string, required — The ISO 4217 three letter currency code. - `endDate` string — Date when regularly scheduled payments end, in ISO 8601 format. - `frequency` string — Specifies the ISO 20022 code for the scheduled frequency of standing order payments occurring between the first and final payments. Options: - `instructions` TransferInstructions, required — Contains the transfer instructions for each payment. - `metadata` Metadata — Information governing or otherwise related to the transfer instructions. - … - `source` TransferDebtorEndpoint — Contains information about the payer account. - … - `transferDestinations` TransferDestination[], required — The beneficiary account specifying the transfer destination, i.e., TPP/merchant/creditor bank account. - … - `remittanceReference` string — Creditor's reference for matching an entry with the items that the transfer is intended to settle, such as commercial invoices in an accounts receivable system. - `returnRefundAccount` boolean — Requests that a refund account be returned in the response of `GET transfers` for any amounts refunded. - `startDate` string — The date when the regularly scheduled payments will start; uses YYYY-MM-DD or YYYYMMDD format. - `actingAs` ActingAs — Specifies another party for whom the token was created 'on behalf of'. - `displayName` string — The name of the recipient shown to the user; required when specifying `actingAs`, optional otherwise. - `refId` string — The TPP-generated reference identifier for the token. This is not to be confused with the `requestId`. The `refId` maps to the `tppRefId` in the bank's `consentRequest`. This is needed to match/verify the originating token request with the bank's consent request.
We recommend that the `refId` should not contain special characters (the allowed characters are the 26-letter Latin alphabet, the numerical digits from 0-9 and the hyphen '-'). This field should not exceed 18 characters in length. - `secondaryName` string — The domain or email address of the recipient shown to the user along with the `displayName`. - `authorizationMetadata` TokenPayloadAuthorizationMetadataEntry — Bank-defined additional authorization properties. - `description` string — Description of the payment with the following qualifiers - `effectiveAtMs` string, string — Sets when the token took effect in milliseconds, 1 day (24 hours) = 8640000000, 1 hour = 36000000, and 1 minute = 60000 - `endorseUntilMs` string, string — The token can be endorsed until this time in milliseconds, 1 day (24 hours) = 8640000000, 1 hour = 36000000, and 1 minute = 60000 - `expiresAtMs` string, string — Token expiration date-time. Access tokens typically have a 90-day lifespan unless overridden by `tokenExpiration` in the original token request. For transfer tokens, this is a bank-optional expiration time. Note - Not all banks support the override of the 90-day default - `from` TokenMember — Contains information identifying the Token.io member. - `alias` Alias — Alternate or additional member identification information. - `realmId` string — Identifies a member created under the realm of a specific bank. - `type` 'INVALID' | 'UNKNOWN' | 'EMAIL' | 'PHONE' | 'DOMAIN' | 'BANK' | 'CUSTOM' | 'EIDAS' — The types of alias available. - `value` string — The alias string representing the type. - `id` string, required — The Token.io-assigned `memberId` of the TPP. - `initiatorId` string — The `memberId` of the member that requested the token creation. - `issuer` TokenMember — Contains information identifying the Token.io member. - `alias` Alias — Alternate or additional member identification information. - `realmId` string — Identifies a member created under the realm of a specific bank. - `type` 'INVALID' | 'UNKNOWN' | 'EMAIL' | 'PHONE' | 'DOMAIN' | 'BANK' | 'CUSTOM' | 'EIDAS' — The types of alias available. - `value` string — The alias string representing the type. - `id` string, required — The Token.io-assigned `memberId` of the TPP. - `receiptRequested` boolean — Indicates whether the TPP requested an email confirmation of the token request be sent to the user. - `refId` string — The TPP-generated reference identifier for the token. This is not to be confused with the `requestId`. The `refId` maps to the `tppRefId` in the bank's `consentRequest`. This is needed to match/verify the originating token request with the bank's consent request.
We recommend that the `refId` should not contain special characters (the allowed characters are the 26-letter Latin alphabet, the numerical digits from 0-9 and the hyphen '-'). This field should not exceed 18 characters in length. - `to` TokenMember — Contains information identifying the Token.io member. - `alias` Alias — Alternate or additional member identification information. - `realmId` string — Identifies a member created under the realm of a specific bank. - `type` 'INVALID' | 'UNKNOWN' | 'EMAIL' | 'PHONE' | 'DOMAIN' | 'BANK' | 'CUSTOM' | 'EIDAS' — The types of alias available. - `value` string — The alias string representing the type. - `id` string, required — The Token.io-assigned `memberId` of the TPP. - `tokenRequestId` string — Identifies the original token request. The value returned in the response to the original token request as the id. - `version` string — Token.io API version number - object - `access` AccessBody — Contains the request payload for a token representing account information access permissions. - `resources` AccessBodyResource[] - `account` AccessBodyResourceAccount — Specifies the account and resource for which access is being requested. - … - `balance` AccessBodyResourceAccountBalance - … - `fundsConfirmation` AccessBodyResourceFundsConfirmation - … - `standingOrders` AccessBodyResourceAccountStandingOrders - … - `transactions` AccessBodyResourceAccountTransactions - … - `transferDestinations` AccessBodyResourceTransferDestinations - … - `transactionHistoryDays` integer — The number of transaction history days. - `actingAs` ActingAs — Specifies another party for whom the token was created 'on behalf of'. - `displayName` string — The name of the recipient shown to the user; required when specifying `actingAs`, optional otherwise. - `refId` string — The TPP-generated reference identifier for the token. This is not to be confused with the `requestId`. The `refId` maps to the `tppRefId` in the bank's `consentRequest`. This is needed to match/verify the originating token request with the bank's consent request.
We recommend that the `refId` should not contain special characters (the allowed characters are the 26-letter Latin alphabet, the numerical digits from 0-9 and the hyphen '-'). This field should not exceed 18 characters in length. - `secondaryName` string — The domain or email address of the recipient shown to the user along with the `displayName`. - `authorizationMetadata` TokenPayloadAuthorizationMetadataEntry — Bank-defined additional authorization properties. - `description` string — Description of the payment with the following qualifiers - `effectiveAtMs` string, string — Sets when the token took effect in milliseconds, 1 day (24 hours) = 8640000000, 1 hour = 36000000, and 1 minute = 60000 - `endorseUntilMs` string, string — The token can be endorsed until this time in milliseconds, 1 day (24 hours) = 8640000000, 1 hour = 36000000, and 1 minute = 60000 - `expiresAtMs` string, string — Token expiration date-time. Access tokens typically have a 90-day lifespan unless overridden by `tokenExpiration` in the original token request. For transfer tokens, this is a bank-optional expiration time. Note - Not all banks support the override of the 90-day default - `from` TokenMember — Contains information identifying the Token.io member. - `alias` Alias — Alternate or additional member identification information. - `realmId` string — Identifies a member created under the realm of a specific bank. - `type` 'INVALID' | 'UNKNOWN' | 'EMAIL' | 'PHONE' | 'DOMAIN' | 'BANK' | 'CUSTOM' | 'EIDAS' — The types of alias available. - `value` string — The alias string representing the type. - `id` string, required — The Token.io-assigned `memberId` of the TPP. - `initiatorId` string — The `memberId` of the member that requested the token creation. - `issuer` TokenMember — Contains information identifying the Token.io member. - `alias` Alias — Alternate or additional member identification information. - `realmId` string — Identifies a member created under the realm of a specific bank. - `type` 'INVALID' | 'UNKNOWN' | 'EMAIL' | 'PHONE' | 'DOMAIN' | 'BANK' | 'CUSTOM' | 'EIDAS' — The types of alias available. - `value` string — The alias string representing the type. - `id` string, required — The Token.io-assigned `memberId` of the TPP. - `receiptRequested` boolean — Indicates whether the TPP requested an email confirmation of the token request be sent to the user. - `refId` string — The TPP-generated reference identifier for the token. This is not to be confused with the `requestId`. The `refId` maps to the `tppRefId` in the bank's `consentRequest`. This is needed to match/verify the originating token request with the bank's consent request.
We recommend that the `refId` should not contain special characters (the allowed characters are the 26-letter Latin alphabet, the numerical digits from 0-9 and the hyphen '-'). This field should not exceed 18 characters in length. - `to` TokenMember — Contains information identifying the Token.io member. - `alias` Alias — Alternate or additional member identification information. - `realmId` string — Identifies a member created under the realm of a specific bank. - `type` 'INVALID' | 'UNKNOWN' | 'EMAIL' | 'PHONE' | 'DOMAIN' | 'BANK' | 'CUSTOM' | 'EIDAS' — The types of alias available. - `value` string — The alias string representing the type. - `id` string, required — The Token.io-assigned `memberId` of the TPP. - `tokenRequestId` string — Identifies the original token request. The value returned in the response to the original token request as the id. - `version` string — Token.io API version number - `payloadSignatures` TokenSignature[] — Contains information about the payload signatures. - `action` 'INVALID' | 'ENDORSED' | 'CANCELED' — Specifies the signature validation action. - `signature` Signature — Contains information about the signing party. This is only present if a `tokenId` is present. It can be used to validate that the provided `tokenId` corresponds to the token request (this is needed for the Hosted Pages flows only). - `keyId` string — The id of the public key used to verify the signature. This is only present if a `tokenId` is present. It can be used to validate that the provided `tokenId` corresponds to the token request (this is needed for Hosted Pages flows only). - `memberId` string — The Token.io member id of the signing member. - `signature` string — The Base64url-encoded ciphertext signature. - `replacedByTokenId` string — The id of the latest token replacing the original `tokenId`. - `tokenRequestId` string — Identifies the original token request. ## Other responses - `400` — The client specified an invalid argument - `401` — The authorization information is missing or invalid - `403` — Permission to access this endpoint is denied - `404` — The requested entity, such as a payment, was not found - `429` — Too many requests - `500` — An unexpected or internal server error - `501` — The operation was not implemented - `503` — Service is unavailable - `504` — Gateway has timed out --- [API](https://skmtc.net/token/apis/token-io-s-open-banking-api-for-tpps.md) · [All operations](https://skmtc.net/token/apis/token-io-s-open-banking-api-for-tpps/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/token/token-io-s-open-banking-api-for-tpps/versions/5e8d6d2c24a1/schema)