> ## Documentation Index > Fetch the complete documentation index at: https://docs.blips.network/llms.txt > Use this file to discover all available pages before exploring further. # List API tokens for your authenticated platform. > Retrieve the API tokens visible on your authenticated platform. The operator-issued root manage token appears as read-only context. Platform-created tokens can carry `view`, `manage`, or both permissions. `clientSecret` is never returned on list surfaces. ## OpenAPI ````yaml /openapi/blips-public-reference.yaml get /tokens openapi: 3.1.0 info: title: BLIPS Public Reference API version: '2026-04-08' description: >- Public OpenAPI 3.1 subset for the first BLIPS Mintlify API Reference and Playground release. This document is bound to the confirmed Public Test Backend at https://public-test.blips.network, includes only the approved first-release public endpoints, uses only internal `$ref` values, and excludes callback-only webhook documentation and operator-only surfaces. servers: - url: https://public-test.blips.network description: >- Confirmed Public Test Backend ingress target for public BLIPS API Reference, Playground, and internet-testable Try It flows. security: - BasicAuth: [] tags: - name: Platform Setup description: >- Bootstrap and platform configuration surfaces for establishing the public BLIPS integration context. - name: Sandbox API description: >- Sandbox-only externally displayed helper surfaces. These routes either adjust quote inputs or create incoming-payment review cases, but they always feed the existing quote or transaction families and never become second outward API families. - name: Tokens description: >- Platform-scoped API credential create, list, detail, and revoke operations. - name: Customers description: >- Customer onboarding, profile lifecycle, and PPV payment-address issuance surfaces. - name: Accounts description: >- Customer-bound internal-account and external-account surfaces kept in the first-layer public contract. - name: Same-Currency Transfers description: >- Same-currency receiver lookup plus incoming and outgoing transfer primitives. - name: Cross-Currency Transfers description: >- PPV-first receiver lookup, quote creation/readback, and quote execution for cross-currency flows. - name: Transactions description: Transaction readback plus bounded incoming-review decision operations. - name: Webhooks description: >- Webhook connectivity verification surface for the public BLIPS integration. paths: /tokens: get: tags: - Tokens summary: List API tokens for your authenticated platform. description: >- Retrieve the API tokens visible on your authenticated platform. The operator-issued root manage token appears as read-only context. Platform-created tokens can carry `view`, `manage`, or both permissions. `clientSecret` is never returned on list surfaces. operationId: listApiTokens responses: '200': description: >- API token list returned. Includes the operator-issued root manage token plus any platform-created tokens with secrets redacted. content: application/json: schema: $ref: '#/components/schemas/TokenListMvpResponse' examples: default: value: data: - id: Token:tok_2f9d7c0ab431 name: Operator management token permissions: - manage accessLevel: management issuerType: operator_issued status: ACTIVE revocable: false clientId: ik_test_2c0d5fd7e1b844f2b72f78b1 createdAt: '2026-04-12T08:00:00Z' updatedAt: '2026-04-12T08:00:00Z' revokedAt: null - id: Token:tok_51ce4ab09d87 name: Demo readback token permissions: - view accessLevel: view_only issuerType: platform_self_service status: ACTIVE revocable: true clientId: ik_test_7fa9f566c2f1467ab03d1f65 createdAt: '2026-04-12T08:15:00Z' updatedAt: '2026-04-12T08:15:00Z' revokedAt: null '400': description: Unsupported query parameters or request body supplied. content: application/json: schema: $ref: '#/components/schemas/TokenDetailErrorResponse' examples: invalidInput: value: status: 400 code: INVALID_REQUEST message: GET /tokens does not accept query parameters. details: query: unsupported '401': description: Invalid or missing API credentials. content: application/json: schema: $ref: '#/components/schemas/TokenDetailErrorResponse' examples: unauthorized: value: status: 401 code: UNAUTHORIZED message: Invalid or missing API credentials. details: {} '403': description: Authenticated token is not allowed to perform manage actions. content: application/json: schema: $ref: '#/components/schemas/TokenDetailErrorResponse' examples: forbidden: value: status: 403 code: FORBIDDEN message: Manage access required. details: requiredAccessLevel: manage '500': description: Internal service error. content: application/json: schema: $ref: '#/components/schemas/TokenDetailErrorResponse' examples: internalServiceError: value: status: 500 code: INTERNAL_ERROR message: Internal service error. details: {} security: - BasicAuth: [] components: schemas: TokenListMvpResponse: type: object additionalProperties: false required: - data properties: data: type: array description: >- API tokens visible on this platform. Includes the operator-issued root manage token plus any platform-created tokens. items: $ref: '#/components/schemas/TokenListMvpItem' TokenDetailErrorResponse: type: object additionalProperties: false required: - status - code - message - details properties: status: type: integer description: HTTP status code returned for the failed token request. code: type: string description: Stable public error code for the failed token request. message: type: string description: Human-readable summary of the token request failure. details: type: object additionalProperties: true description: >- Additional structured error context when the token request exposes one. TokenListMvpItem: type: object additionalProperties: false required: - id - name - permissions - accessLevel - issuerType - status - revocable - clientId - createdAt - updatedAt - revokedAt properties: id: type: string description: Stable public API-key identifier in `Token:` form. name: type: string description: Human-readable API-key label. permissions: type: array description: Public permissions granted to this token. items: $ref: '#/components/schemas/TokenPermission' accessLevel: type: string enum: - management - view_only description: Compatibility access-level projection shown in Platform Config. issuerType: type: string enum: - operator_issued - platform_self_service description: >- Whether the token is operator-issued or created from Platform Config. status: type: string description: Current key lifecycle state returned by runtime readback. revocable: type: boolean description: Whether Platform Config may revoke this token. clientId: type: string description: Client identifier used for Basic Auth. createdAt: type: string format: date-time description: API-key creation timestamp. updatedAt: type: string format: date-time description: Most recent API-key update timestamp. revokedAt: type: - string - 'null' format: date-time description: Revocation timestamp. `null` while the key is still active. TokenPermission: type: string enum: - view - manage description: >- Public API token permission. `view` covers read access and `manage` covers token-management and other privileged platform actions. securitySchemes: BasicAuth: type: http scheme: basic description: >- Integration-key Basic Auth (`clientId:clientSecret`) as documented in docs/public/AUTHENTICATION.md. ````