API tokens

The same tokens you manage in Space settings. Useful for auditing what has programmatic access, and for revoking under automation.

List tokens

GET/api/v1/tokens

Query parameters

filterstring: A FiltrQL expression, url-encoded. Combine with AND / OR and parentheses. See the Filtering page for the full operator list, or call /filter-reference for the live one.; status = 'PASSED' AND executedAt > now-7d
sortstring: Comma-separated field list. Prefix a field with a minus for descending order.; -createdAt,name
page[number]integer: Which page to return, starting at 1.; 2
page[size]integer: Results per page. Defaults to 25, and the maximum is 100.; 50
includestring: Comma-separated relationships to side-load into the response, saving a second request. Chains up to 3 deep.; requirement,folder
fields[type]string: Return only these attributes for the named resource type - a sparse fieldset. Cuts payload size sharply on wide entities.; fields[test_cases]=name,status

Headers

Authorizationstringrequired: Your API token as a bearer credential.; Bearer bst_pat_YOUR_TOKEN_HERE
Acceptstringrequired: Must be application/vnd.api+json. Any other value returns 406 Not Acceptable.; application/vnd.api+json

Attributes returned19

confinedClaimBasisany
createdAtdate-time
customClaimsany
delegationChainany
delegationDepthinteger
expiresAtdate-time
iduuid
jtistring

Show the remaining 11

lastUsedAtdate-time | null
mintedBystring | null
minterRolestring | null
mintScopeBasisany
namestring
organizationIduuid
ownerIdstring | null
ownerTypestring
revokedAtdate-time | null
rolestring
scopesstring[] | null

Responses

200OK.
403The token is missing, expired, revoked, aimed at another Space, or lacks write access.
404No such resource, or it is outside the Space your token reaches.
406The Accept header did not include application/vnd.api+json.
429Rate limit exceeded: 100 requests a minute per token, shared with MCP.

Request

curl

curl "https://prod-eu.getbestest.com/api/v1/tokens?page%5Bsize%5D=25" \
  -H "Authorization: Bearer bst_pat_YOUR_TOKEN_HERE" \
  -H "Accept: application/vnd.api+json"

Response

application/vnd.api+json

{
  "data": [
    {
      "type": "tokens",
      "id": "3f2b9c14-8d5e-4a71-9f60-2c1e7b4a8d33",
      "attributes": {
        "name": "Checkout rejects an expired card",
        "createdAt": "2026-08-18T09:30:00Z",
        "confinedClaimBasis": "string",
        "customClaims": "string",
        "delegationChain": "string",
        "delegationDepth": 1,
        "expiresAt": "2026-08-18T09:30:00Z",
        "jti": "string"
      }
    }
  ],
  "meta": {
    "totalCount": 128
  },
  "links": {
    "first": "/api/v1/tokens?page[number]=1",
    "next": "/api/v1/tokens?page[number]=2"
  }
}

Show an error response

Error

any 4xx

{
  "errors": [
    {
      "status": "403",
      "title": "Forbidden",
      "code": "FORBIDDEN",
      "detail": "Access denied.",
      "source": {
        "pointer": "/data"
      }
    }
  ]
}

Get a token

GET/api/v1/tokens/{id}

Path parameters

idstringrequired: The resource id (a UUID).

Headers

Authorizationstringrequired: Your API token as a bearer credential.; Bearer bst_pat_YOUR_TOKEN_HERE
Acceptstringrequired: Must be application/vnd.api+json. Any other value returns 406 Not Acceptable.; application/vnd.api+json

Attributes returned19

confinedClaimBasisany
createdAtdate-time
customClaimsany
delegationChainany
delegationDepthinteger
expiresAtdate-time
iduuid
jtistring

Show the remaining 11

lastUsedAtdate-time | null
mintedBystring | null
minterRolestring | null
mintScopeBasisany
namestring
organizationIduuid
ownerIdstring | null
ownerTypestring
revokedAtdate-time | null
rolestring
scopesstring[] | null

Responses

200OK.
403The token is missing, expired, revoked, aimed at another Space, or lacks write access.
404No such resource, or it is outside the Space your token reaches.
406The Accept header did not include application/vnd.api+json.
429Rate limit exceeded: 100 requests a minute per token, shared with MCP.

Request

curl

curl "https://prod-eu.getbestest.com/api/v1/tokens/3f2b9c14-8d5e-4a71-9f60-2c1e7b4a8d33" \
  -H "Authorization: Bearer bst_pat_YOUR_TOKEN_HERE" \
  -H "Accept: application/vnd.api+json"

Response

application/vnd.api+json

{
  "data": {
    "type": "tokens",
    "id": "3f2b9c14-8d5e-4a71-9f60-2c1e7b4a8d33",
    "attributes": {
      "name": "Checkout rejects an expired card",
      "createdAt": "2026-08-18T09:30:00Z",
      "confinedClaimBasis": "string",
      "customClaims": "string",
      "delegationChain": "string",
      "delegationDepth": 1,
      "expiresAt": "2026-08-18T09:30:00Z",
      "jti": "string"
    }
  }
}

Show an error response

Error

any 4xx

{
  "errors": [
    {
      "status": "403",
      "title": "Forbidden",
      "code": "FORBIDDEN",
      "detail": "Access denied.",
      "source": {
        "pointer": "/data"
      }
    }
  ]
}

Aggregate tokens

GET/api/v1/tokens/aggregate

Headers

Authorizationstringrequired: Your API token as a bearer credential.; Bearer bst_pat_YOUR_TOKEN_HERE
Acceptstringrequired: Must be application/vnd.api+json. Any other value returns 406 Not Acceptable.; application/vnd.api+json

Responses

200OK.
403The token is missing, expired, revoked, aimed at another Space, or lacks write access.
404No such resource, or it is outside the Space your token reaches.
406The Accept header did not include application/vnd.api+json.
429Rate limit exceeded: 100 requests a minute per token, shared with MCP.

Request

curl

curl "https://prod-eu.getbestest.com/api/v1/tokens/aggregate" \
  -H "Authorization: Bearer bst_pat_YOUR_TOKEN_HERE" \
  -H "Accept: application/vnd.api+json"

Response

application/vnd.api+json

{
  "meta": {
    "count": 128
  }
}

Show an error response

Error

any 4xx

{
  "errors": [
    {
      "status": "403",
      "title": "Forbidden",
      "code": "FORBIDDEN",
      "detail": "Access denied.",
      "source": {
        "pointer": "/data"
      }
    }
  ]
}

Describe the token schema

GET/api/v1/tokens/schema

Query parameters

filterstring: A FiltrQL expression, url-encoded. Combine with AND / OR and parentheses. See the Filtering page for the full operator list, or call /filter-reference for the live one.; status = 'PASSED' AND executedAt > now-7d
sortstring: Comma-separated field list. Prefix a field with a minus for descending order.; -createdAt,name
page[number]integer: Which page to return, starting at 1.; 2
page[size]integer: Results per page. Defaults to 25, and the maximum is 100.; 50
includestring: Comma-separated relationships to side-load into the response, saving a second request. Chains up to 3 deep.; requirement,folder
fields[type]string: Return only these attributes for the named resource type - a sparse fieldset. Cuts payload size sharply on wide entities.; fields[test_cases]=name,status

Headers

Authorizationstringrequired: Your API token as a bearer credential.; Bearer bst_pat_YOUR_TOKEN_HERE
Acceptstringrequired: Must be application/vnd.api+json. Any other value returns 406 Not Acceptable.; application/vnd.api+json

Responses

200OK.
403The token is missing, expired, revoked, aimed at another Space, or lacks write access.
404No such resource, or it is outside the Space your token reaches.
406The Accept header did not include application/vnd.api+json.
429Rate limit exceeded: 100 requests a minute per token, shared with MCP.

Request

curl

curl "https://prod-eu.getbestest.com/api/v1/tokens/schema?page%5Bsize%5D=25" \
  -H "Authorization: Bearer bst_pat_YOUR_TOKEN_HERE" \
  -H "Accept: application/vnd.api+json"

Response

application/vnd.api+json

{
  "data": [
    {
      "type": "tokens",
      "id": "3f2b9c14-8d5e-4a71-9f60-2c1e7b4a8d33",
      "attributes": {}
    }
  ],
  "meta": {
    "totalCount": 128
  },
  "links": {
    "first": "/api/v1/tokens?page[number]=1",
    "next": "/api/v1/tokens?page[number]=2"
  }
}

Show an error response

Error

any 4xx

{
  "errors": [
    {
      "status": "403",
      "title": "Forbidden",
      "code": "FORBIDDEN",
      "detail": "Access denied.",
      "source": {
        "pointer": "/data"
      }
    }
  ]
}