Skip to content
LANrurugi

API Tokens

4 endpoints.

List API tokens

Section titled “List API tokens”
GEThttp://localhost:3000/api/tokens

Every issued token’s metadata. The token secret itself is never included: it is returned exactly once, by the creation call below, and is not stored in a recoverable form.

Requires a session-cookie login.

Responses

200The issued tokens.
[
  {
    "created_at": 0,
    "expires_at": 0,
    "id": "",
    "last_used_at": 0,
    "last_used_ip": "",
    "name": "",
    "role": "admin"
  }
]

This endpoint accepts a browser session only — the cookie set when you log in to your own instance. API tokens are refused by the server, so there is no token field here and the command above carries no Authorization header.

Your own instance address. Requests go from this browser straight to it.

Create an API token

Section titled “Create an API token”
POSThttp://localhost:3000/api/tokens

Issues a new token and returns its secret — the only time it is ever returned. Store it then; it cannot be recovered afterwards, only replaced.

The expiry is computed from the server’s own clock, not from a client-supplied timestamp, so a client with a skewed clock cannot mint a token that outlives what it asked for.

Request body

application/json

Responses

200The token, including its secret under `data.token`.
null
400The name was empty.
{
  "error": "",
  "operation": "",
  "success": 0,
  "successMessage": ""
}

This endpoint accepts a browser session only — the cookie set when you log in to your own instance. API tokens are refused by the server, so there is no token field here and the command above carries no Authorization header.

Your own instance address. Requests go from this browser straight to it.

Revoke an API token

Section titled “Revoke an API token”
DELETEhttp://localhost:3000/api/tokens/{id}

Permanently revokes a token. Anything still using it starts failing immediately; the token cannot be un-revoked, only replaced.

Requires a session-cookie login.

Path parameters

idstringrequired

Responses

200Revoked.
{
  "error": "",
  "operation": "",
  "success": 0,
  "successMessage": ""
}
404No such token.
{
  "error": "",
  "operation": "",
  "success": 0,
  "successMessage": ""
}

This endpoint accepts a browser session only — the cookie set when you log in to your own instance. API tokens are refused by the server, so there is no token field here and the command above carries no Authorization header.

Your own instance address. Requests go from this browser straight to it.

Rename an API token

Section titled “Rename an API token”
PATCHhttp://localhost:3000/api/tokens/{id}

Changes a token’s label. Requires a session-cookie login.

Path parameters

idstringrequired

Request body

application/json

Responses

200The renamed token.
null
404No such token.
{
  "error": "",
  "operation": "",
  "success": 0,
  "successMessage": ""
}

This endpoint accepts a browser session only — the cookie set when you log in to your own instance. API tokens are refused by the server, so there is no token field here and the command above carries no Authorization header.

Your own instance address. Requests go from this browser straight to it.