> ## Documentation Index > Fetch the complete documentation index at: https://developers.askparable.com/llms.txt > Use this file to discover all available pages before exploring further. # Turn personal access tokens on or off > Allows or refuses personal access tokens in the selected Workspace. A token does not go through the Workspace's sign-in method, so turning tokens off refuses every token on its next query and stops members creating new ones; turning them back on lets unexpired, unrevoked tokens work again. Requires permission to manage the Workspace's sign-in. ## Access This operation needs a Parable token. An MCP token cannot call it. See [Authentication](/getting-started/authentication.md) for the kinds of token. Your roles must grant `tenant.auth.manage`. ## OpenAPI ````yaml /api-reference/openapi.json put /api/auth/api-tokens-enabled openapi: 3.0.3 info: description: >- Use the Workspace API to work with artifacts, connectors, Parables, and account resources. title: Workspace API version: v2026.10.22.1 servers: [] security: [] paths: /api/auth/api-tokens-enabled: put: tags: - Auth summary: Turn personal access tokens on or off description: >- Allows or refuses personal access tokens in the selected Workspace. A token does not go through the Workspace's sign-in method, so turning tokens off refuses every token on its next query and stops members creating new ones; turning them back on lets unexpired, unrevoked tokens work again. Requires permission to manage the Workspace's sign-in. operationId: AuthSetApiTokensEnabledHandler parameters: - description: >- Workspace slug. Overrides subdomain-based workspace resolution when provided. in: header name: X-Tenant required: false schema: example: acme type: string - description: Optional request correlation ID echoed back in the response. in: header name: X-Request-ID required: false schema: example: 550e8400-e29b-41d4-a716-446655440000 format: uuid type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/SetApiTokensEnabledInput' required: true responses: '200': content: application/json: schema: properties: data: $ref: '#/components/schemas/TenantLoginPolicy' links: $ref: '#/components/schemas/ResponseLinks' meta: $ref: '#/components/schemas/ResponseMeta' required: - data - meta type: object description: Successful response headers: X-Request-ID: $ref: '#/components/headers/X-Request-ID' '400': content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' description: >- The request is not valid. `detail` says why. A value that breaks a field rule gives the code `WA-VL-001` and an `errors` member that names each field. headers: X-Request-ID: $ref: '#/components/headers/X-Request-ID' '401': content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' description: The token is missing, malformed, revoked, or expired. headers: X-Request-ID: $ref: '#/components/headers/X-Request-ID' '403': content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' description: >- The token cannot make this request. For example, the roles of its owner do not allow the operation. headers: X-Request-ID: $ref: '#/components/headers/X-Request-ID' '429': content: text/plain: schema: example: Too Many Requests type: string description: >- More than 10 requests a minute came from your address. Wait for the number of seconds in `Retry-After`, then try again. headers: Retry-After: description: The number of seconds to wait before you try again. schema: type: integer X-Request-ID: $ref: '#/components/headers/X-Request-ID' '500': content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' description: The request failed on the server. headers: X-Request-ID: $ref: '#/components/headers/X-Request-ID' security: - bearerAuth: [] x-codeSamples: - label: TypeScript SDK lang: typescript source: >- import { WebApiSDK } from "@parable-platform/web-api-sdk"; import type { SetApiTokensEnabledInput } from "@parable-platform/web-api-types"; const sdk = new WebApiSDK({ baseUrl: process.env.PARABLE_API_URL!, auth: { token: process.env.PARABLE_API_TOKEN! }, requestInterceptor: (config) => ({ ...config, headers: { ...config.headers, "X-Tenant": process.env.PARABLE_WORKSPACE! }, }), }); const input: SetApiTokensEnabledInput = JSON.parse(`{ "enabled": true }`); const result = await sdk.auth.setApiTokensEnabled( input ); - label: Python SDK lang: python source: |- import json import os from parable_types_web_api import SetApiTokensEnabledInput from parable_web_api_sdk import ClientConfig, WebApiSDK sdk = WebApiSDK( ClientConfig( base_url=os.environ["PARABLE_API_URL"], auth_token=os.environ["PARABLE_API_TOKEN"], default_headers={"X-Tenant": os.environ["PARABLE_WORKSPACE"]}, ) ) input_data = SetApiTokensEnabledInput.model_validate( json.loads("{\"enabled\":true}"), ) result = sdk.auth.set_api_tokens_enabled(input_data) - label: Rust SDK lang: rust source: >- use parable_web_api_sdk::{types, ClientConfig, RequestOptions, WebApiSdk}; let sdk = WebApiSdk::new(ClientConfig::with_base_url( std::env::var("PARABLE_API_URL")?, Some(std::env::var("PARABLE_API_TOKEN")?), None, ))?; let options = RequestOptions::with_header("X-Tenant", std::env::var("PARABLE_WORKSPACE")?, None, None); let input: types::SetApiTokensEnabledInput = serde_json::from_value( serde_json::json!({ "enabled": true }), )?; let result = sdk.auth.set_api_tokens_enabled( input, Some(&options) ).await?; - label: Go SDK lang: go source: "sdk, err := webapisdk.New(webapisdk.SDKConfig{\n\tBaseURL: os.Getenv(\"PARABLE_API_URL\"),\n\tAuth: &webapisdk.AuthConfig{Token: os.Getenv(\"PARABLE_API_TOKEN\")},\n\tRequestInterceptor: func(ctx context.Context, req *http.Request) error {\n\t\treq.Header.Set(\"X-Tenant\", os.Getenv(\"PARABLE_WORKSPACE\"))\n\t\treturn nil\n\t},\n})\nif err != nil {\n\treturn err\n}\n\nvar input webapitypes.SetApiTokensEnabledInput\nif err := json.Unmarshal([]byte(`{\"enabled\":true}`), &input); err != nil {\n\treturn err\n}\nresult, err := sdk.AuthNamespace.SetApiTokensEnabled(ctx, input)" components: schemas: SetApiTokensEnabledInput: description: |- Input for turning personal access tokens on or off in the selected Workspace. properties: enabled: type: boolean required: - enabled type: object TenantLoginPolicy: description: >- Customer API projection of workspace login policy (no SCIM token fingerprint). properties: activeMethod: oneOf: - $ref: '#/components/schemas/LoginMethodEnum' - enum: - null nullable: true type: string allowedMethods: items: $ref: '#/components/schemas/LoginMethodEnum' type: array apiTokensEnabled: description: Whether personal access tokens may reach this Workspace. type: boolean breakglassEmail: description: An email address format: email maxLength: 255 nullable: true pattern: ^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$ type: string createdAt: description: >- ISO8601 datetime string. Epoch wire values keep this scalar and declare x-temporal-format (unix, unix_millis, unix_micros, unix_nanos) on the property; the unit is never guessed from digit count. format: date-time type: string createdBy: description: UUID v4 string as base62 pattern: ^[0-9A-Za-z]{1,22}$ type: string externalAgentAccessEnabled: description: >- Whether agents outside Parable may read this Workspace through the MCP endpoint. Off until an administrator turns it on. type: boolean id: description: UUID v4 with automatic base62 encoding for client-facing APIs pattern: >- ^([0-9A-Za-z]{1,22}|[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$ type: string lastRefreshedFromStytchAt: description: >- ISO8601 datetime string. Epoch wire values keep this scalar and declare x-temporal-format (unix, unix_millis, unix_micros, unix_nanos) on the property; the unit is never guessed from digit count. format: date-time nullable: true type: string lastTestConfigFingerprint: nullable: true type: string lastTestSucceededAt: description: >- ISO8601 datetime string. Epoch wire values keep this scalar and declare x-temporal-format (unix, unix_millis, unix_micros, unix_nanos) on the property; the unit is never guessed from digit count. format: date-time nullable: true type: string scimConnectionId: nullable: true type: string scimDefaultRoleId: description: UUID v4 with automatic base62 encoding for client-facing APIs nullable: true pattern: >- ^([0-9A-Za-z]{1,22}|[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$ type: string scimEnabled: type: boolean ssoConnectionId: nullable: true type: string tenantId: description: UUID v4 with automatic base62 encoding for client-facing APIs pattern: >- ^([0-9A-Za-z]{1,22}|[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$ type: string updatedAt: description: >- ISO8601 datetime string. Epoch wire values keep this scalar and declare x-temporal-format (unix, unix_millis, unix_micros, unix_nanos) on the property; the unit is never guessed from digit count. format: date-time type: string updatedBy: description: UUID v4 string as base62 pattern: ^[0-9A-Za-z]{1,22}$ type: string required: - id - createdAt - createdBy - updatedAt - updatedBy - tenantId - allowedMethods - scimEnabled - apiTokensEnabled - externalAgentAccessEnabled type: object ResponseLinks: properties: first: nullable: true type: string last: nullable: true type: string next: nullable: true type: string prev: nullable: true type: string type: object ResponseMeta: properties: requestId: description: Unique identifier for the request type: string totalCount: description: Total count of items for paginated responses nullable: true type: integer required: - requestId type: object ProblemDetails: description: An error response in the Problem Details format (RFC 9457). properties: code: description: The stable error code, when the problem has one. example: WA-VL-001 type: string detail: description: What went wrong with this request. type: string details: description: >- Structured facts about the refusal, such as the entity or the path it concerns. Only some refusals have it. errors: description: >- The fields or filters that failed validation. Only a validation or filter error has it. requestId: description: >- The ID of the request, when the problem has one. The `X-Request-ID` response header always has it. type: string status: description: The HTTP status code. example: 400 type: integer title: description: A short summary, usually the text of the HTTP status. example: Bad Request type: string type: description: >- The problem type. It is `about:blank`: the status and `code` identify the problem. example: about:blank type: string required: - type - title - status - detail type: object LoginMethodEnum: description: A way that people can sign in to a Workspace. enum: - magic_link - passkey - google - microsoft - oidc - saml type: string headers: X-Request-ID: description: >- The ID of the request. It is the `X-Request-ID` value that you sent, or an ID that the server made. Give it when you report a problem. schema: type: string securitySchemes: bearerAuth: description: >- A personal access token, which starts with `pat_`. A Parable token can call each operation that the roles of its owner allow. An MCP token can call only the read operations that are open to agents. A SQL token does not work on this API. scheme: bearer type: http ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.