---
title: "List Organization Tokens"
description: "Returns all API tokens for the organization. Tokens are masked: only the first 8 characters are shown. Requires admin role."
---

`GET /api/organization/tokens`

## Example (cURL)

```bash
curl -X GET "$BASE_URL/api/organization/tokens" \
  -H "Cookie: $SESSION_COOKIE" \
  -H "Accept: application/json"
```

## Response

```json
[
  {
    "id": 1,
    "organizationId": 1,
    "name": "Production API",
    "customerId": null,
    "customerName": null,
    "lastUsedAt": "2026-04-01T12:00:00.000Z",
    "expiresAt": null,
    "createdAt": "2026-01-15T10:00:00.000Z",
    "tokenHint": "wsm_a1b2c..."
  }
]
```

## Common errors

- `401 Unauthorized` when not authenticated
- `403 Forbidden` when not an admin