--- id: v1-personal-access-tokens title: PersonalAccessTokens pagination_label: PersonalAccessTokens sidebar_label: PersonalAccessTokens sidebar_class_name: typescriptsdk keywords: ['typescript', 'TypeScript', 'sdk', 'PersonalAccessTokens', 'v1PersonalAccessTokens'] slug: /tools/sdk/typescript/personal_access_tokens/methods/personal-access-tokens tags: ['SDK', 'Software Development Kit', 'PersonalAccessTokens', 'v1PersonalAccessTokens'] --- # PersonalAccessTokensApi Use this API to implement personal access token (PAT) functionality. With this functionality in place, users can use PATs as an alternative to passwords for authentication in Identity Security Cloud. PATs embed user information into the client ID and secret. This replaces the API clients' need to store and provide a username and password to establish a connection, improving Identity Security Cloud organizations' integration security. In Identity Security Cloud, users can do the following to create and manage their PATs: Select the dropdown menu under their names, select Preferences, and then select Personal Access Tokens. They must then provide a description about the token's purpose. They can then select 'Create Token' at the bottom of the page to generate and view the Secret and Client ID. Refer to [Managing Personal Access Tokens](https://documentation.sailpoint.com/saas/help/common/api_keys.html?h=token#generating-a-personal-access-token) for more information about PATs. All URIs are relative to *https://sailpoint.api.identitynow.com* Method | HTTP request | Description ------------- | ------------- | ------------- [**create-personal-access-token-v1**](#create-personal-access-token-v1) | **POST** `/personal-access-tokens/v1` | Create personal access token [**delete-personal-access-token-v1**](#delete-personal-access-token-v1) | **DELETE** `/personal-access-tokens/v1/{id}` | Delete personal access token [**list-personal-access-tokens-v1**](#list-personal-access-tokens-v1) | **GET** `/personal-access-tokens/v1` | List personal access tokens [**patch-personal-access-token-v1**](#patch-personal-access-token-v1) | **PATCH** `/personal-access-tokens/v1/{id}` | Patch personal access token ## create-personal-access-token-v1 Create personal access token This creates a personal access token. **expirationDate and userAwareTokenNeverExpires Relationship:** **Important:** When `expirationDate` is `null` or empty (not included in the request body), the token will never expire. **Required Validation:** If `expirationDate` is `null` or empty, `userAwareTokenNeverExpires` must be set to `true`. This is a required validation rule. The valid values for `expirationDate` depend on the value provided for `userAwareTokenNeverExpires`: * **When `userAwareTokenNeverExpires` is `true` (or required to be `true`):** `expirationDate` can be `null` or omitted from the request body. When `expirationDate` is `null` or empty, the token will never expire. This creates a PAT that never expires and serves as an explicit acknowledgment that the user is aware of the security implications of creating a non-expiring token. * **When `userAwareTokenNeverExpires` is `false` or omitted:** `expirationDate` must be provided and must be a valid date-time string representing a future date (there is no upper limit). `expirationDate` cannot be `null` in this case. In this scenario, `userAwareTokenNeverExpires` can be omitted. **Validation Rules:** * **If `expirationDate` is `null` or not included in the request body:** `userAwareTokenNeverExpires` must be set to `true` (required). The token will never expire. * **If `expirationDate` is provided and is not `null`:** `userAwareTokenNeverExpires` can be omitted. **Security Considerations:** The `userAwareTokenNeverExpires` field is designed to ensure that users explicitly acknowledge the security implications of creating tokens that never expire. Setting this field to `true` indicates that the user understands the increased security risks and has made an informed decision to proceed. **Note:** The `userAwareTokenNeverExpires` field indicates that the user acknowledges they are creating a token that will never expire. It does not affect token behavior beyond indicating this acknowledgment. [API Spec](https://developer.sailpoint.com/docs/api/create-personal-access-token-v-1) ### Parameters Name | Type | Description | Notes ------------- | ------------- | ------------- | ------------- **createPersonalAccessTokenRequest** | `CreatePersonalAccessTokenRequest` | Configuration for creating a personal access token, including name, scope, expiration settings, and user acknowledgment of never-expiring tokens. **Important:** See the endpoint description for validation rules regarding the relationship between `expirationDate` and `userAwareTokenNeverExpires`. | ### Return type `CreatePersonalAccessTokenResponse` ### HTTP request headers - **Content-Type**: application/json - **Accept**: application/json ### Example ```typescript import { PersonalAccessTokensApi } from 'sailpoint-api-client'; import { Configuration } from 'sailpoint-api-client'; import { CreatePersonalAccessTokenRequest } from 'sailpoint-api-client/dist/personal_access_tokens/api'; const configuration = new Configuration(); const apiInstance = new PersonalAccessTokensApi(configuration); const createPersonalAccessTokenRequest: CreatePersonalAccessTokenRequest = { "scope" : [ "demo:personal-access-token-scope:first", "demo:personal-access-token-scope:second" ], "accessTokenValiditySeconds" : 36900, "name" : "NodeJS Integration", "userAwareTokenNeverExpires" : false, "expirationDate" : "2026-12-31T23:59:59.999Z" }; // Configuration for creating a personal access token, including name, scope, expiration settings, and user acknowledgment of never-expiring tokens. **Important:** See the endpoint description for validation rules regarding the relationship between `expirationDate` and `userAwareTokenNeverExpires`. const result = await apiInstance.createPersonalAccessTokenV1({ createPersonalAccessTokenRequest: createPersonalAccessTokenRequest }); console.log(result); ``` [[Back to top]](#) ## delete-personal-access-token-v1 Delete personal access token This deletes a personal access token. [API Spec](https://developer.sailpoint.com/docs/api/delete-personal-access-token-v-1) ### Parameters Name | Type | Description | Notes ------------- | ------------- | ------------- | ------------- **id** | `string` | The personal access token id | [default to undefined] ### Return type (empty response body) ### HTTP request headers - **Content-Type**: Not defined - **Accept**: application/json ### Example ```typescript import { PersonalAccessTokensApi } from 'sailpoint-api-client'; import { Configuration } from 'sailpoint-api-client'; const configuration = new Configuration(); const apiInstance = new PersonalAccessTokensApi(configuration); const id: string = ef38f94347e94562b5bb8424a56397d8; // The personal access token id const result = await apiInstance.deletePersonalAccessTokenV1({ id: id }); console.log(result); ``` [[Back to top]](#) ## list-personal-access-tokens-v1 List personal access tokens This gets a collection of personal access tokens associated with the optional `owner-id`. query parameter. If the `owner-id` query parameter is omitted, all personal access tokens for a tenant will be retrieved, but the caller must have the 'idn:all-personal-access-tokens:read' right. [API Spec](https://developer.sailpoint.com/docs/api/list-personal-access-tokens-v-1) ### Parameters Name | Type | Description | Notes ------------- | ------------- | ------------- | ------------- **ownerId** | `string` | The identity ID of the owner whose personal access tokens should be listed. If \"me\", the caller should have the following right: \'idn:my-personal-access-tokens:read\' If an actual owner ID or if the `owner-id` parameter is omitted in the request, the caller should have the following right: \'idn:all-personal-access-tokens:read\'. If the caller has the following right, then managed personal access tokens associated with `owner-id` will be retrieved: \'idn:managed-personal-access-tokens:read\' | [optional] [default to undefined] **filters** | `string` | Filter results using the standard syntax described in [V3 API Standard Collection Parameters](https://developer.sailpoint.com/idn/api/standard-collection-parameters#filtering-results) Filtering is supported for the following fields and operators: **lastUsed**: *le, isnull* | [optional] [default to undefined] ### Return type `Array` ### HTTP request headers - **Content-Type**: Not defined - **Accept**: application/json ### Example ```typescript import { PersonalAccessTokensApi } from 'sailpoint-api-client'; import { Configuration } from 'sailpoint-api-client'; const configuration = new Configuration(); const apiInstance = new PersonalAccessTokensApi(configuration); const ownerId: string = 2c9180867b50d088017b554662fb281e; // The identity ID of the owner whose personal access tokens should be listed. If \"me\", the caller should have the following right: \'idn:my-personal-access-tokens:read\' If an actual owner ID or if the `owner-id` parameter is omitted in the request, the caller should have the following right: \'idn:all-personal-access-tokens:read\'. If the caller has the following right, then managed personal access tokens associated with `owner-id` will be retrieved: \'idn:managed-personal-access-tokens:read\' (optional) const filters: string = lastUsed le 2023-02-05T10:59:27.214Z; // Filter results using the standard syntax described in [V3 API Standard Collection Parameters](https://developer.sailpoint.com/idn/api/standard-collection-parameters#filtering-results) Filtering is supported for the following fields and operators: **lastUsed**: *le, isnull* (optional) const result = await apiInstance.listPersonalAccessTokensV1({ }); console.log(result); ``` [[Back to top]](#) ## patch-personal-access-token-v1 Patch personal access token This performs a targeted update to the field(s) of a Personal Access Token. Changing scopes for a Personal Access Token does not impact existing bearer tokens. You will need to create a new bearer token to have the new scopes. Please note that it can take up to 20 minutes for scope changes to be seen on new bearer tokens. **expirationDate and userAwareTokenNeverExpires Relationship:** **Important:** When `expirationDate` is `null` or empty (replaced to `null` or omitted from the patch request), the token will never expire. **Required Validation:** If `expirationDate` is being replaced to `null` or is empty, `userAwareTokenNeverExpires` must be set to `true` in the patch request. This is a required validation rule. When patching `expirationDate` and `userAwareTokenNeverExpires`, the valid values for `expirationDate` depend on the value provided for `userAwareTokenNeverExpires`: * **When `userAwareTokenNeverExpires` is being set to `true` (or required to be `true`):** `expirationDate` can be replaced to `null` or omitted from the patch request. When `expirationDate` is `null` or empty, the token will never expire. This sets the PAT to never expire and serves as an explicit acknowledgment that the user is aware of the security implications of creating a non-expiring token. * **When `userAwareTokenNeverExpires` is `false` or omitted:** `expirationDate` must be provided and must be a valid date-time string representing a future date (there is no upper limit). `expirationDate` cannot be `null` in this case. In this scenario, `userAwareTokenNeverExpires` can be omitted. **Validation Rules:** * **If `expirationDate` is being replaced to `null`:** `userAwareTokenNeverExpires` must also be present in the patch request with a value of `true` (required). The token will never expire. * **If `expirationDate` is not being replaced to `null` (i.e., set to a future date):** `userAwareTokenNeverExpires` can be omitted. **Security Considerations:** The `userAwareTokenNeverExpires` field is designed to ensure that users explicitly acknowledge the security implications of creating tokens that never expire. Setting this field to `true` indicates that the user understands the increased security risks and has made an informed decision to proceed. **Note:** The `userAwareTokenNeverExpires` field indicates that the user acknowledges they are creating a token that will never expire. It does not affect token behavior beyond indicating this acknowledgment. [API Spec](https://developer.sailpoint.com/docs/api/patch-personal-access-token-v-1) ### Parameters Name | Type | Description | Notes ------------- | ------------- | ------------- | ------------- **id** | `string` | The Personal Access Token id | [default to undefined] **jsonPatchOperation** | `Array` | A list of OAuth client update operations according to the [JSON Patch](https://tools.ietf.org/html/rfc6902) standard. The following fields are patchable: * name * scope * expirationDate * userAwareTokenNeverExpires **Important:** See the endpoint description for validation rules regarding the relationship between `expirationDate` and `userAwareTokenNeverExpires`. | ### Return type `GetPersonalAccessTokenResponse` ### HTTP request headers - **Content-Type**: application/json-patch+json - **Accept**: application/json ### Example ```typescript import { PersonalAccessTokensApi } from 'sailpoint-api-client'; import { Configuration } from 'sailpoint-api-client'; import { JsonPatchOperation } from 'sailpoint-api-client/dist/personal_access_tokens/api'; const configuration = new Configuration(); const apiInstance = new PersonalAccessTokensApi(configuration); const id: string = ef38f94347e94562b5bb8424a56397d8; // The Personal Access Token id const jsonPatchOperation: Array = { "op" : "replace", "path" : "/description", "value" : "New description" }; // A list of OAuth client update operations according to the [JSON Patch](https://tools.ietf.org/html/rfc6902) standard. The following fields are patchable: * name * scope * expirationDate * userAwareTokenNeverExpires **Important:** See the endpoint description for validation rules regarding the relationship between `expirationDate` and `userAwareTokenNeverExpires`. const result = await apiInstance.patchPersonalAccessTokenV1({ id: id, jsonPatchOperation: jsonPatchOperation }); console.log(result); ``` [[Back to top]](#)