Administration API

API tokens for scripts and automation: list, create and revoke them. This page lists 3 operations.

Set variables in the API overview. Download OpenAPI.

Operations

Details

GET /api/v1/tokens

API tokens, active and revoked (never the tokens themselves). Needs manage-tokens.

Operation ID: tokens

Needs: manage-tokens.

Example request. Replace sample names, IDs and body values with resources and settings from your installation.

curl --fail-with-body -sS -X GET "$APELORA_URL/api/v1/tokens" \
  -H "Authorization: Bearer $APELORA_TOKEN" \
  -H "Accept: application/json"

TypeScript:

const result = await client.request("tokens", {});

Response 200 — Done; the response holds the result..

Content-Type: application/json.

Example response from a test installation; your IDs, names and times differ.

{
  "items": [
    {
      "id": "e4cbf3b6-13b4-48e5-a3b7-1372bf90bd37",
      "name": "docs-verifier",
      "role": "fabric-admin",
      "createdAt": "2026-10-28T23:26:42.234541Z",
      "expiresAt": "2026-10-29T23:26:42.183819Z",
      "revokedAt": null,
      "lastUsedAt": "2026-10-28T23:26:49.510582Z"
    }
  ]
}

Errors. The body is {"error": {"code": …, "message": …}}; see error codes for the codes every operation shares.

POST /api/v1/tokens

Creates an API token, shown only in this response. Needs manage-tokens and every permission the token's role carries (a token never does more than its creator). A fabric-admin token also needs another person's approval of token.create_admin on token:fabric-admin, sent as Apelora-Approval; an API token cannot present one, so it cannot create fabric-admin tokens.

Operation ID: create_token

Needs: manage-tokens and every permission the token's role carries (a token never does more than its creator).

Request body (JSON):

{
  "name": "monitoring",
  "role": "operator",
  "expiresInDays": 90
}

Example request. Replace sample names, IDs and body values with resources and settings from your installation.

This request can change state. Check permissions, prerequisites and any required approval before running it.

curl --fail-with-body -sS -X POST "$APELORA_URL/api/v1/tokens" \
  -H "Authorization: Bearer $APELORA_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  --data-raw '{"name":"monitoring","role":"operator","expiresInDays":90}'

With options (Apelora-Approval):

# APPROVAL_ID: the id of the approval another person granted (POST /api/v1/approvals).
curl --fail-with-body -sS -X POST "$APELORA_URL/api/v1/tokens" \
  -H "Authorization: Bearer $APELORA_TOKEN" \
  -H "Accept: application/json" \
  -H "Apelora-Approval: $APPROVAL_ID" \
  -H "Content-Type: application/json" \
  --data-raw '{"name":"backup-site-admin","role":"fabric-admin","expiresInDays":30}'

TypeScript:

const result = await client.request("create_token", { body: { name: "monitoring", role: "operator", expiresInDays: 90 } });

Response 201 — Created; the response describes what was created..

Content-Type: application/json.

Example response from a test installation; your IDs, names and times differ.

{
  "token": "<token, shown once>",
  "info": {
    "id": "f457dbc1-a9e4-4a26-9ecb-691033f991b7",
    "name": "monitoring",
    "role": "operator",
    "createdAt": "2026-10-28T23:26:49.535364Z",
    "expiresAt": "2027-01-26T23:26:49.533328Z",
    "revokedAt": null,
    "lastUsedAt": null
  }
}

Errors. The body is {"error": {"code": …, "message": …}}; see error codes for the codes every operation shares.

DELETE /api/v1/tokens/{id}

Revokes an API token; it stops working at once. Needs manage-tokens.

Operation ID: revoke_token

Needs: manage-tokens.

Example request. Replace sample names, IDs and body values with resources and settings from your installation.

This request can change state. Check permissions, prerequisites and any required approval before running it.

curl --fail-with-body -sS -X DELETE "$APELORA_URL/api/v1/tokens/f457dbc1-a9e4-4a26-9ecb-691033f991b7" \
  -H "Authorization: Bearer $APELORA_TOKEN"

TypeScript:

await client.request("revoke_token", { params: { id: "f457dbc1-a9e4-4a26-9ecb-691033f991b7" } });

Response 204 — Done; nothing is returned., with no body.

Errors. The body is {"error": {"code": …, "message": …}}; see error codes for the codes every operation shares.