List Pats
curl --request GET \
--url https://api.example.com/organization-pats \
--header 'Authorization: Bearer <token>'import requests
url = "https://api.example.com/organization-pats"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.example.com/organization-pats', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.example.com/organization-pats",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.example.com/organization-pats"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.example.com/organization-pats")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.example.com/organization-pats")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body[
{
"id": "<string>",
"name": "<string>",
"key_id": "<string>",
"pat_key": "<string>",
"expires_at": "<string>",
"created_at": "<string>",
"owner_user_id": "<string>",
"owner_name": "<string>"
}
]PATs
List Organization API Keys
GET
/
organization-pats
List Pats
curl --request GET \
--url https://api.example.com/organization-pats \
--header 'Authorization: Bearer <token>'import requests
url = "https://api.example.com/organization-pats"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.example.com/organization-pats', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.example.com/organization-pats",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.example.com/organization-pats"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.example.com/organization-pats")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.example.com/organization-pats")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body[
{
"id": "<string>",
"name": "<string>",
"key_id": "<string>",
"pat_key": "<string>",
"expires_at": "<string>",
"created_at": "<string>",
"owner_user_id": "<string>",
"owner_name": "<string>"
}
]Organization API keys (
ak_…) are AnyCRM’s own credential type — see Authentication for how they differ from user personal access tokens. All eight PAT/key management endpoints are gated on the token-management scopes (pats:read, pats:create, pats:delete), which every default role carries.
Auth
Requirespats:read and an active organization. Results are filtered to the caller’s own user_id and, through row-level security, the token’s active organization.
A caller holding organizations:manage (the admin role) instead gets every key in the organization, so an admin can revoke a departed member’s key — see Delete an Organization API Key. Keys owned by another member carry owner_user_id and owner_name; the admin’s own keys leave both null, so the two are always distinguishable.
Response
200 OK — a bare JSON array (no envelope), ordered newest-first.
| Field | Type | Description |
|---|---|---|
id | string (uuid) | The key’s row id in the pats table — use this for Delete an Organization API Key. |
name | string | Label given at creation. |
pat_key | null | Always null on list — the plaintext secret is only ever returned once, on create. |
key_id | string | First 15 characters of the internal ak_<hex> key id — a display-only partial identifier, not the full id and not enough to reconstruct the secret. |
expires_at | string | null | ISO 8601 timestamp, or null if the key never expires. |
created_at | string | null | ISO 8601 timestamp. |
owner_user_id | string | null | The Logto user id of the member who owns the key — set only when that isn’t you, so it is always null outside the admin view. |
owner_name | string | null | Display name (or email) for owner_user_id. null when the key is yours, or when the name couldn’t be resolved — the listing still succeeds, just unlabelled. |
Authorizations
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.