List tokens
The names, rungs, expiry and last use of the tokens this token's owner holds. No token value is kept anywhere, so none is answered.
Authorization
memberToken The tools internkim uses inside a company, callable from outside it. A token belongs to a person, and every call runs as that person, so a token can never do more than its owner can.
The first token is made signed in, from the settings screen. After that a token makes its own
successors: POST /token for a new one, DELETE /token for the old one, so a script rotates
without a browser. A token can neither mint a rung above its own nor revoke itself.
Send Authorization: Bearer <token> on every request.
In: header
Response Body
application/json
text/plain
text/plain
curl -X GET "https://example.com/tokens"{ "tokens": [ { "name": "string", "permission": "read", "expiresAt": "2019-08-24T14:15:22Z", "lastUsedAt": "2019-08-24T14:15:22Z" } ]}Make a token POST
Issues a token to the same person as the one calling. `permission` defaults to the calling rung and may not reach past it. Omitting `name` takes the first ordinal nobody holds. A token expires after `expiresInDays`, 90 when omitted and at most 365; an expired one is renewed by making another by the same name. The `token` field is shown this once and never again.
Revoke a token DELETE
Revokes one token by name. The token authenticating the call cannot be the one revoked: see the replacement answer first, then revoke the old one with it.