list_tokens
List the authenticated person's own personal access tokens with abilities and scope tuples split out. The plaintext value is never shown.
List the authenticated person's own personal access tokens with abilities and scope tuples split out. scope:team:... and scope:project:... entries are peeled off the raw abilities array into a structured scopes object for readability, and abilities_count counts the gate abilities alone. The plaintext token value is never surfaced; minting happens under Account Settings → API Tokens.
Requires ability
The token behind the MCP session must hold it, or the call is refused with TOKEN_MISSING_ABILITY.
Runs the same action as
The REST endpoint and this tool share one action, so validation, permissions and events are identical.
Annotations
It reads and never changes anything.
Arguments
This tool takes no arguments.
What it returns
{ "data": [ { "id": "1284", "name": "Cursor on the CRM repository", "abilities": ["project:view-any", "project:view", "activity:read"], "scopes": { "team_id": "a83f0d51-4c92-4b7e-8615-2fd9e70a3c86", "project_ids": ["7f3d1c92-8b45-4e6a-9d21-5c8e0a4b6f13"] }, "abilities_count": 3, "last_used_at": "2026-10-26T09:15:00+00:00", "expires_at": null, "created_at": "2026-10-01T10:05:00+00:00" } ], "meta": { "total": 1 }}A token's id is an integer serialised as a string, the one exception to the UUID rule every other id follows.
How it fails
AUTHENTICATION_REQUIREDno authenticated user on the request.
TOKEN_MISSING_ABILITYtoken lacks token:view-any.
How is this guide?
Last updated on