--- title: "Workspace Tokens API Reference" description: "Endpoints for managing workspace tokens in Linkbreakers. These endpoints allow you to create, list, and delete workspace tokens for authentication." canonical: "https://linkbreakers.com/help/api/workspace-tokens" --- # Workspace Tokens Endpoints for managing workspace tokens in Linkbreakers. These endpoints allow you to create, list, and delete workspace tokens for authentication. ## Workspace Tokens ## [#](#workspace-tokens-object)The Workspace Token object Describes a long-lived credential Linkbreakers issues so back-end integrations can call workspace APIs without a human session, while keeping auditing metadata for security reviews. createdAt string (date-time) The timestamp when the token was created createdBy string The member who created the token (UUID of creator) fullAccess boolean True when the token may call every endpoint, including ones behind scopes added later. Tokens created without scopes have full access. id string The unique identifier of the workspace token (UUID) keyType string (enum) The key type of the token (secret or publishable) ##### Allowed values `WORKSPACE_TOKEN_KEY_TYPE_UNSPECIFIED` Default value (should not be used) `WORKSPACE_TOKEN_KEY_TYPE_SECRET` Secret key with full API access `WORKSPACE_TOKEN_KEY_TYPE_PUBLISHABLE` Publishable key with limited access lastUsedAt string (date-time) The timestamp when the token was last used name string The name of the token scopes array The scopes the token holds. With full access, every scope that exists today. support boolean True when Linkbreakers support issued the token to act on the workspace. Its calls do not count toward the workspace's API usage. Delete it to revoke support's access. updatedAt string (date-time) The timestamp when the token was last updated workspaceId string The workspace ID the token belongs to (UUID) Example object ```json { "createdAt": "2026-10-25T05:41:44.637Z", "createdBy": "123e4567-e89b-12d3-a456-426614174000", "fullAccess": false, "id": "d22f7bf1-83a9-4f3a-9b37-9a3a21b6ac11", "keyType": "WORKSPACE_TOKEN_KEY_TYPE_UNSPECIFIED", "lastUsedAt": "2026-10-25T05:41:44.637Z", "name": "Production token", "scopes": [ "API_SCOPE_UNSPECIFIED" ], "support": false, "updatedAt": "2026-10-25T05:41:44.637Z", "workspaceId": "c0d3cafe-5b1e-4d42-a6fd-0c5f5c3962d0" } ``` GET `/v1/workspace-tokens` Requires auth ## [#](#list-workspace-tokens)List workspace tokens Enumerate all active workspace tokens for auditing and management. Requires the \`tokens:read\` scope. ### [#](#list-workspace-tokens-parameters)Parameters #### query parameters pageSize integer (int64) query Maximum number to return. Defaults to 100, capped at 1000. pageToken string query Cursor from a previous response's next\_page\_token. Empty starts at the first page. Pages are ordered by (created\_at, id), which never change, so a record cannot move between pages while a client is walking them. cursor string query Opaque cursor from the previous page's nextPageToken. Same as pageToken; when both are sent, pageToken wins. ### [#](#list-workspace-tokens-response)Response 200 Everything worked as expected. nextPageToken string Cursor to continue listing tokens. Empty on the last page. tokens array Tokens scoped to the calling workspace totalCount integer (int64) How many records exist in total, so a client can tell a complete answer from a page of one. A local-first client reads absence from this list as deletion, and may only do so when the count it was given matches what it received: without that, one page would look like the whole model and everything beyond it would be removed locally. ### [#](#list-workspace-tokens-error)Error response 400-599 All endpoints may return an unexpected error payload when a request cannot be processed. error object Required Wrapped error response. Example request (cURL) ```bash curl -X GET "https://api.linkbreakers.com/v1/workspace-tokens?pageSize={pageSize}&pageToken={pageToken}&cursor={cursor}" \ -H "Authorization: Bearer YOUR_TOKEN" ``` Typical response ```json { "nextPageToken": "string", "tokens": [ { "createdAt": "2026-10-25T05:41:44.636Z", "createdBy": "123e4567-e89b-12d3-a456-426614174000", "fullAccess": false, "id": "d22f7bf1-83a9-4f3a-9b37-9a3a21b6ac11", "keyType": "WORKSPACE_TOKEN_KEY_TYPE_UNSPECIFIED", "lastUsedAt": "2026-10-25T05:41:44.636Z", "name": "Production token", "scopes": [ "API_SCOPE_UNSPECIFIED" ], "support": false, "updatedAt": "2026-10-25T05:41:44.636Z", "workspaceId": "c0d3cafe-5b1e-4d42-a6fd-0c5f5c3962d0" } ], "totalCount": 0 } ``` Base URL: `https://api.linkbreakers.com` GET `/v1/workspace-tokens/{id}` Requires auth ## [#](#get-a-workspace-token)Get a workspace token Retrieve metadata for a specific workspace token without revealing its secret. Requires the \`tokens:read\` scope. ### [#](#get-a-workspace-token-parameters)Parameters #### path parameters id string Required path Identifier of the desired token (UUID) ### [#](#get-a-workspace-token-response)Response 200 Everything worked as expected. token object Describes a long-lived credential Linkbreakers issues so back-end integrations can call workspace APIs without a human session, while keeping auditing metadata for security reviews. ### [#](#get-a-workspace-token-error)Error response 400-599 All endpoints may return an unexpected error payload when a request cannot be processed. error object Required Wrapped error response. Example request (cURL) ```bash curl -X GET "https://api.linkbreakers.com/v1/workspace-tokens/{id}" \ -H "Authorization: Bearer YOUR_TOKEN" ``` Typical response ```json { "token": { "createdAt": "2026-10-25T05:41:44.637Z", "createdBy": "123e4567-e89b-12d3-a456-426614174000", "fullAccess": false, "id": "d22f7bf1-83a9-4f3a-9b37-9a3a21b6ac11", "keyType": "WORKSPACE_TOKEN_KEY_TYPE_UNSPECIFIED", "lastUsedAt": "2026-10-25T05:41:44.637Z", "name": "Production token", "scopes": [ "API_SCOPE_UNSPECIFIED" ], "support": false, "updatedAt": "2026-10-25T05:41:44.637Z", "workspaceId": "c0d3cafe-5b1e-4d42-a6fd-0c5f5c3962d0" } } ``` Base URL: `https://api.linkbreakers.com` POST `/v1/workspace-tokens` Requires auth ## [#](#create-a-workspace-token)Create a workspace token Generate a new long-lived API token and return the one-time access secret. Requires the \`tokens:write\` scope. ### [#](#create-a-workspace-token-parameters)Parameters #### header parameters Idempotency-Key string header Makes retrying this request safe. See components.parameters.IdempotencyKey. ### [#](#create-a-workspace-token-request)Request body keyType string (enum) Required The key type of the token (required) ##### Allowed values `WORKSPACE_TOKEN_KEY_TYPE_UNSPECIFIED` Default value (should not be used) `WORKSPACE_TOKEN_KEY_TYPE_SECRET` Secret key with full API access `WORKSPACE_TOKEN_KEY_TYPE_PUBLISHABLE` Publishable key with limited access name string The name of the token scopes array The scopes the token may use. Leave empty for full access. A write scope also grants the read scope of the same resource. Publishable keys take no scopes. A token can only grant scopes it holds itself. ### [#](#create-a-workspace-token-response)Response 200 Everything worked as expected. accessToken string The actual JWT token to be used for authentication. It is returned only once and cannot be retrieved again. token object Describes a long-lived credential Linkbreakers issues so back-end integrations can call workspace APIs without a human session, while keeping auditing metadata for security reviews. ### [#](#create-a-workspace-token-error)Error response 400-599 All endpoints may return an unexpected error payload when a request cannot be processed. error object Required Wrapped error response. Example request (cURL) ```bash curl -X POST "https://api.linkbreakers.com/v1/workspace-tokens" \ -H "Authorization: Bearer YOUR_TOKEN" \ -H "Idempotency-Key: string" \ -H "Content-Type: application/json" \ --data '{"keyType":"WORKSPACE_TOKEN_KEY_TYPE_UNSPECIFIED","name":"string","scopes":["API_SCOPE_UNSPECIFIED"]}' ``` Sample payload (application/json) ```json { "keyType": "WORKSPACE_TOKEN_KEY_TYPE_UNSPECIFIED", "name": "string", "scopes": [ "API_SCOPE_UNSPECIFIED" ] } ``` Typical response ```json { "accessToken": "string", "token": { "createdAt": "2026-10-25T05:41:44.637Z", "createdBy": "123e4567-e89b-12d3-a456-426614174000", "fullAccess": false, "id": "d22f7bf1-83a9-4f3a-9b37-9a3a21b6ac11", "keyType": "WORKSPACE_TOKEN_KEY_TYPE_UNSPECIFIED", "lastUsedAt": "2026-10-25T05:41:44.637Z", "name": "Production token", "scopes": [ "API_SCOPE_UNSPECIFIED" ], "support": false, "updatedAt": "2026-10-25T05:41:44.637Z", "workspaceId": "c0d3cafe-5b1e-4d42-a6fd-0c5f5c3962d0" } } ``` Base URL: `https://api.linkbreakers.com` PATCH `/v1/workspace-tokens/{id}` Requires auth ## [#](#update-a-workspace-token)Update a workspace token Rename a workspace token or change its scopes. Changes reach every request within 30 seconds. A token can only grant scopes it holds itself. Requires the \`tokens:write\` scope. ### [#](#update-a-workspace-token-parameters)Parameters #### path parameters id string Required path Identifier of the token to update (UUID) #### header parameters Idempotency-Key string header Makes retrying this request safe. See components.parameters.IdempotencyKey. ### [#](#update-a-workspace-token-request)Request body fullAccess boolean Set to true to give the token full access again. Cannot be combined with scopes. name string New name for the token. Left unchanged when omitted. scopes array Replace the token's scopes with these. Cannot be combined with full\_access. ### [#](#update-a-workspace-token-response)Response 200 Everything worked as expected. token object Describes a long-lived credential Linkbreakers issues so back-end integrations can call workspace APIs without a human session, while keeping auditing metadata for security reviews. ### [#](#update-a-workspace-token-error)Error response 400-599 All endpoints may return an unexpected error payload when a request cannot be processed. error object Required Wrapped error response. Example request (cURL) ```bash curl -X PATCH "https://api.linkbreakers.com/v1/workspace-tokens/{id}" \ -H "Authorization: Bearer YOUR_TOKEN" \ -H "Idempotency-Key: string" \ -H "Content-Type: application/json" \ --data '{"fullAccess":false,"name":"string","scopes":["API_SCOPE_UNSPECIFIED"]}' ``` Sample payload (application/json) ```json { "fullAccess": false, "name": "string", "scopes": [ "API_SCOPE_UNSPECIFIED" ] } ``` Typical response ```json { "token": { "createdAt": "2026-10-25T05:41:44.637Z", "createdBy": "123e4567-e89b-12d3-a456-426614174000", "fullAccess": false, "id": "d22f7bf1-83a9-4f3a-9b37-9a3a21b6ac11", "keyType": "WORKSPACE_TOKEN_KEY_TYPE_UNSPECIFIED", "lastUsedAt": "2026-10-25T05:41:44.637Z", "name": "Production token", "scopes": [ "API_SCOPE_UNSPECIFIED" ], "support": false, "updatedAt": "2026-10-25T05:41:44.637Z", "workspaceId": "c0d3cafe-5b1e-4d42-a6fd-0c5f5c3962d0" } } ``` Base URL: `https://api.linkbreakers.com` DELETE `/v1/workspace-tokens/{id}` Requires auth ## [#](#delete-a-workspace-token)Delete a workspace token Revoke a workspace token immediately so it can no longer authenticate. Requires the \`tokens:write\` scope. ### [#](#delete-a-workspace-token-parameters)Parameters #### path parameters id string Required path Identifier of the token to revoke (UUID) ### [#](#delete-a-workspace-token-response)Response 200 Everything worked as expected. No structured schema available for this section. ### [#](#delete-a-workspace-token-error)Error response 400-599 All endpoints may return an unexpected error payload when a request cannot be processed. error object Required Wrapped error response. Example request (cURL) ```bash curl -X DELETE "https://api.linkbreakers.com/v1/workspace-tokens/{id}" \ -H "Authorization: Bearer YOUR_TOKEN" ``` Typical response ```json {} ``` Base URL: `https://api.linkbreakers.com` --- Source: https://linkbreakers.com/help/api/workspace-tokens