# List tokens URL: https://docs.hanzo.ai/docs/openapi/iam/listtokens > Returns the access tokens issued in your organization, newest first, and can be narrowed to one organization. `GET /v1/iam/tokens` > [IAM →](https://docs.hanzo.ai/docs/openapi/iam) · [All API references →](https://docs.hanzo.ai/docs/openapi) · [Get started →](https://docs.hanzo.ai/docs/guides) | | | | ------------- | -------------------------------------- | | **Address** | `https://api.hanzo.ai/v1/iam/tokens` | | **Method** | `GET` | | **Operation** | `listTokens` | | **Auth** | `Authorization: Bearer $HANZO_API_KEY` | Returns the access tokens issued in your organization, newest first, and can be narrowed to one organization. Use it to see what is currently authorized before revoking anything. ## Request 2 fields. | Field | In | Type | Required | Description | | -------------- | ----- | ------ | -------- | ----------- | | `owner` | query | string | — | | | `organization` | query | string | — | | ## Response | Status | Body | Meaning | | --------- | ----------------- | ----------------- | | `200` | iam.listTokensOut | ok | | `202` | Approval | held for approval | | `default` | problem-details | refused | `200` body — 31 fields. | Field | In | Type | Always | Description | | ------------------------------ | ---- | ------------------ | ------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `tokens` | body | iam.Token\[] | — | | | `tokens[].accessToken` | body | string | — | | | `tokens[].accessTokenHash` | body | string | — | | | `tokens[].application` | body | string | — | | | `tokens[].code` | body | string | — | | | `tokens[].codeChallenge` | body | string | — | | | `tokens[].codeChallengeMethod` | body | string | — | | | `tokens[].codeExpireIn` | body | integer (int64) | — | | | `tokens[].codeIsUsed` | body | boolean | — | | | `tokens[].createdAt` | body | string (date-time) | — | | | `tokens[].createdTime` | body | string | — | | | `tokens[].deleted` | body | boolean | — | | | `tokens[].expiresIn` | body | integer (int64) | — | | | `tokens[].id` | body | string | — | | | `tokens[].name` | body | string | — | | | `tokens[].nonce` | body | string | — | Nonce is the OIDC authorize nonce, stored on the code and echoed into the id\_token minted at the exchange (OIDC Core §3.1.3.6) so a relying party binds the id\_token to its own request and detects replay. | | `tokens[].organization` | body | string | — | | | `tokens[].owner` | body | string | — | | | `tokens[].publicGrant` | body | boolean | — | PublicGrant records that this grant was established WITHOUT client authentication — a PKCE code exchange from a client that presented no secret. | | `tokens[].redirectUri` | body | string | — | RedirectUri binds the authorization code to the exact redirect URI of the authorize request (RFC 6749 §4.1.3): the token endpoint refuses a code redeemed with a different redirect\_uri, closing code-injection across a client's registered URIs. | | `tokens[].refreshConsumed` | body | boolean | — | | | `tokens[].refreshExpireIn` | body | integer (int64) | — | | | `tokens[].refreshFamily` | body | string | — | Refresh-token rotation state (v2). | | `tokens[].refreshToken` | body | string | — | | | `tokens[].refreshTokenHash` | body | string | — | | | `tokens[].resource` | body | string | — | RFC 8707 resource indicator | | `tokens[].scope` | body | string | — | | | `tokens[].tokenType` | body | string | — | | | `tokens[].updatedAt` | body | string (date-time) | — | | | `tokens[].user` | body | string | — | | | `tokens[].userCode` | body | string | — | | Failure carries the platform error shape — see [Errors](https://docs.hanzo.ai/docs/errors). ## Examples **CLI** ```bash hanzo iam tokens list ``` **SDK** **.ts** ```ts import { Configuration, IamApi } from 'hanzoai'; const api = new IamApi(new Configuration({ accessToken: process.env.HANZO_API_KEY })); const { data } = await api.listTokens(); ``` **.py** ```python from hanzoai.cloud import ApiClient, Configuration from hanzoai.cloud.api import IamApi client = ApiClient(Configuration(access_token=os.environ["HANZO_API_KEY"])) result = IamApi(client).list_tokens() ``` **.go** ```go cfg := hanzoai.NewConfiguration() cfg.AddDefaultHeader("Authorization", "Bearer "+os.Getenv("HANZO_API_KEY")) client := hanzoai.NewAPIClient(cfg) resp, _, err := client.IamAPI.ListTokens(context.Background()).Execute() if err != nil { return err } ``` **.rs** ```rust use hanzo_client::apis::{configuration::Configuration, iam_api}; let mut cfg = Configuration::new(); cfg.bearer_access_token = std::env::var("HANZO_API_KEY").ok(); let result = iam_api::list_tokens(&cfg, Default::default()).await?; ``` **.java** ```java import ai.hanzo.cloud.ApiClient; import ai.hanzo.cloud.api.IamApi; ApiClient client = new ApiClient(); client.setBearerToken(System.getenv("HANZO_API_KEY")); var result = new IamApi(client).listTokens(); ``` **HTTP** ```bash curl https://api.hanzo.ai/v1/iam/tokens \ -H "Authorization: Bearer $HANZO_API_KEY" ``` **MCP** MCP reaches **iam** through the `iam` tool, which names its 44 operations with its own verbs — this one among them, under a name only MCP declares. `describe` explains any of them: ```bash curl -X POST https://api.hanzo.ai/v1/mcp \ -H "Content-Type: application/json" \ -d '{ "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": "describe", "arguments": { "op": "list_iam_applications" } } }' ``` --- [IAM API](https://docs.hanzo.ai/docs/openapi/iam) · [All Hanzo APIs](https://docs.hanzo.ai/docs/openapi) · [Interactive reference](https://docs.hanzo.ai/docs/openapi/reference)