> ## Documentation Index > Fetch the complete documentation index at: https://developers.askparable.com/llms.txt > Use this file to discover all available pages before exploring further. # List the Workspace's personal access tokens > Lists every personal access token the selected Workspace's members created, for SQL and for MCP, newest first, with each token's owner, and revoked and expired ones. Values are never returned. Requires permission to manage the Workspace's people. ## Access This operation needs a Parable token. An MCP token cannot call it. See [Authentication](/getting-started/authentication.md) for the kinds of token. Your roles must grant `tenant.user.manage`. ## OpenAPI ````yaml /api-reference/openapi.json get /api/api-tokens/workspace openapi: 3.0.3 info: description: >- Use the Workspace API to work with artifacts, connectors, Parables, and account resources. title: Workspace API version: v2026.10.22.1 servers: [] security: [] paths: /api/api-tokens/workspace: get: tags: - API tokens summary: List the Workspace's personal access tokens description: >- Lists every personal access token the selected Workspace's members created, for SQL and for MCP, newest first, with each token's owner, and revoked and expired ones. Values are never returned. Requires permission to manage the Workspace's people. operationId: ApiTokensWorkspaceApiTokensHandler parameters: - description: >- Workspace slug. Overrides subdomain-based workspace resolution when provided. in: header name: X-Tenant required: false schema: example: acme type: string - description: Optional request correlation ID echoed back in the response. in: header name: X-Request-ID required: false schema: example: 550e8400-e29b-41d4-a716-446655440000 format: uuid type: string responses: '200': content: application/json: schema: properties: data: items: $ref: '#/components/schemas/WorkspaceApiToken' type: array links: $ref: '#/components/schemas/ResponseLinks' meta: $ref: '#/components/schemas/ResponseMeta' required: - data - meta type: object description: Successful response headers: X-Request-ID: $ref: '#/components/headers/X-Request-ID' '400': content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' description: The request is not valid. `detail` says why. headers: X-Request-ID: $ref: '#/components/headers/X-Request-ID' '401': content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' description: The token is missing, malformed, revoked, or expired. headers: X-Request-ID: $ref: '#/components/headers/X-Request-ID' '403': content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' description: >- The token cannot make this request. For example, the roles of its owner do not allow the operation. headers: X-Request-ID: $ref: '#/components/headers/X-Request-ID' '500': content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' description: The request failed on the server. headers: X-Request-ID: $ref: '#/components/headers/X-Request-ID' security: - bearerAuth: [] x-codeSamples: - label: TypeScript SDK lang: typescript source: |- import { WebApiSDK } from "@parable-platform/web-api-sdk"; const sdk = new WebApiSDK({ baseUrl: process.env.PARABLE_API_URL!, auth: { token: process.env.PARABLE_API_TOKEN! }, requestInterceptor: (config) => ({ ...config, headers: { ...config.headers, "X-Tenant": process.env.PARABLE_WORKSPACE! }, }), }); const result = await sdk.apiTokens.workspaceApiTokens(); - label: Python SDK lang: python source: |- import os from parable_web_api_sdk import ClientConfig, WebApiSDK sdk = WebApiSDK( ClientConfig( base_url=os.environ["PARABLE_API_URL"], auth_token=os.environ["PARABLE_API_TOKEN"], default_headers={"X-Tenant": os.environ["PARABLE_WORKSPACE"]}, ) ) result = sdk.api_tokens.workspace_api_tokens() - label: Rust SDK lang: rust source: >- use parable_web_api_sdk::{ClientConfig, RequestOptions, WebApiSdk}; let sdk = WebApiSdk::new(ClientConfig::with_base_url( std::env::var("PARABLE_API_URL")?, Some(std::env::var("PARABLE_API_TOKEN")?), None, ))?; let options = RequestOptions::with_header("X-Tenant", std::env::var("PARABLE_WORKSPACE")?, None, None); let result = sdk.api_tokens.workspace_api_tokens( Some(&options) ).await?; - label: Go SDK lang: go source: "sdk, err := webapisdk.New(webapisdk.SDKConfig{\n\tBaseURL: os.Getenv(\"PARABLE_API_URL\"),\n\tAuth: &webapisdk.AuthConfig{Token: os.Getenv(\"PARABLE_API_TOKEN\")},\n\tRequestInterceptor: func(ctx context.Context, req *http.Request) error {\n\t\treq.Header.Set(\"X-Tenant\", os.Getenv(\"PARABLE_WORKSPACE\"))\n\t\treturn nil\n\t},\n})\nif err != nil {\n\treturn err\n}\n\nresult, err := sdk.ApiTokensNamespace.WorkspaceApiTokens(ctx)" components: schemas: WorkspaceApiToken: description: >- A personal access token a Workspace member created in this Workspace, for SQL over Flight or for an MCP host,. Metadata only: the token's value is returned once, by createApiToken, and its hash never. properties: audience: $ref: '#/components/schemas/ApiTokenAudienceEnum' description: |- Where the token works: flight_sql (SQL over Flight only) or mcp (the Workspace API's read-only operations only). Never all. createdAt: description: >- ISO8601 datetime string. Epoch wire values keep this scalar and declare x-temporal-format (unix, unix_millis, unix_micros, unix_nanos) on the property; the unit is never guessed from digit count. format: date-time type: string expiresAt: description: When the token stops working. Every token a member creates has one. format: date-time nullable: true type: string id: description: UUID v4 with automatic base62 encoding for client-facing APIs pattern: >- ^([0-9A-Za-z]{1,22}|[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$ type: string lastUsedAt: description: >- The last time the token authenticated a request. Null when never used. format: date-time nullable: true type: string name: description: The label its owner gave it, such as "DBeaver on my laptop". type: string ownerEmail: description: An email address format: email maxLength: 255 pattern: ^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$ type: string ownerName: description: An objects name maxLength: 80 minLength: 2 type: string ownerUserId: description: The member the token belongs to and acts as. pattern: ^[0-9A-Za-z]{1,22}$ type: string prefix: description: >- The token's first 12 characters, pat_ included, to tell tokens apart. type: string revokedAt: description: >- When the token was revoked. A revoked token is kept for the record and refused. format: date-time nullable: true type: string required: - id - createdAt - name - prefix - audience - ownerUserId - ownerName - ownerEmail type: object ResponseLinks: properties: first: nullable: true type: string last: nullable: true type: string next: nullable: true type: string prev: nullable: true type: string type: object ResponseMeta: properties: requestId: description: Unique identifier for the request type: string totalCount: description: Total count of items for paginated responses nullable: true type: integer required: - requestId type: object ProblemDetails: description: An error response in the Problem Details format (RFC 9457). properties: code: description: The stable error code, when the problem has one. example: WA-VL-001 type: string detail: description: What went wrong with this request. type: string details: description: >- Structured facts about the refusal, such as the entity or the path it concerns. Only some refusals have it. errors: description: >- The fields or filters that failed validation. Only a validation or filter error has it. requestId: description: >- The ID of the request, when the problem has one. The `X-Request-ID` response header always has it. type: string status: description: The HTTP status code. example: 400 type: integer title: description: A short summary, usually the text of the HTTP status. example: Bad Request type: string type: description: >- The problem type. It is `about:blank`: the status and `code` identify the problem. example: about:blank type: string required: - type - title - status - detail type: object ApiTokenAudienceEnum: description: Where a personal access token (pat_) may be used,. enum: - all - flight_sql - mcp type: string headers: X-Request-ID: description: >- The ID of the request. It is the `X-Request-ID` value that you sent, or an ID that the server made. Give it when you report a problem. schema: type: string securitySchemes: bearerAuth: description: >- A personal access token, which starts with `pat_`. A Parable token can call each operation that the roles of its owner allow. An MCP token can call only the read operations that are open to agents. A SQL token does not work on this API. scheme: bearer type: http ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.