Appearance
List current user's API tokens
GET
/personal_access_tokens
Returns all personal access tokens for the authenticated user, ordered by creation date (newest first). Admins can pass user_id to list another user's tokens. Token digests are never exposed. Session auth only — token-authenticated requests receive 403.
Authorizations
cookieAuth
Type
API Key (cookie: _vulcan_session)
Parameters
Query Parameters
user_id
Admin-only. List tokens for this user instead of the current user.
Type
integer
Example
42Responses
Token list
application/json
JSON "personal_access_tokens": [ { "id": 1, "name": "CI Pipeline", "token_prefix": "vulcan_a", "scopes": [ "read", "write" ], "expires_at": "2026-08-30", "last_used_at": "2026-05-30 14:22:01 UTC", "revoked_at": null, "allowed_ips": null, "created_at": "2026-05-30 10:00:00 UTC" } ]
{
}
Create a new API token
POST
/personal_access_tokens
Creates a personal access token ON THE SIGNED-IN ACCOUNT. The raw token is returned ONCE in the response — it is never stored or retrievable after this. Requires current password for session hijack protection. Session auth only. Max 20 active tokens per user, max 365-day lifetime. Ownership can never be redirected: a token authenticates AS its owner, so no caller — administrators included — may mint one on another user's account, and any user_id supplied in the body is ignored. Administrators oversee other users' tokens by listing (GET with user_id) and revoking them; account recovery goes through a password reset, where the user re-authenticates.
Authorizations
cookieAuth
Type
API Key (cookie: _vulcan_session)
Request Body
application/json
JSON "personal_access_token": { "name": "CI Pipeline", "scopes": [ [ "read", "write" ] ], "expires_at": "2026-08-30", "allowed_ips": [ [ "10.0.0.0/8" ] ], "current_password": "string" }
{
}
Responses
Token created — raw token shown once
application/json
JSON "token": "vulcan_a8BfDtSxd28fDXCuYaKxkeToqqJsmq5PekL6", "personal_access_token": { "id": 1, "name": "CI Pipeline", "token_prefix": "vulcan_a", "scopes": [ [ "read", "write" ] ], "expires_at": "2026-08-30", "last_used_at": "2026-05-30 14:22:01 UTC", "revoked_at": "string", "allowed_ips": [ ], "created_at": "2026-05-30 10:00:00 UTC" }
{
}
Revoke an API token
DELETE
/personal_access_tokens/{tokenId}
Soft-deletes the token by setting revoked_at. The token immediately stops working for API authentication. Audit trail is preserved. Session auth only — users can only revoke their own tokens.
Authorizations
cookieAuth
Type
API Key (cookie: _vulcan_session)
Responses
Token revoked
application/json
JSON "toast": { "title": "User updated.", "message": [ [ "Successfully updated user." ] ], "variant": "success" }
{
}
Admin revoke any user's token
DELETE
/personal_access_tokens/{tokenId}/admin_revoke
Admin-only endpoint. Revokes any user's token with a required audit comment explaining the reason (e.g. compromised credentials). The audit comment is recorded in the audit trail. Session auth only.
Authorizations
cookieAuth
Type
API Key (cookie: _vulcan_session)
Request Body
application/json
JSON "audit_comment": "Compromised credentials reported by user."
{
}
Responses
Token revoked by admin
application/json
JSON "toast": { "title": "User updated.", "message": [ [ "Successfully updated user." ] ], "variant": "success" }
{
}