token.* events
Personal access token minting and revocation.
Personal access token minting and revocation. A token is what authorises every REST and MCP call, so a security mirror subscribes here to watch credential churn on the team. These are account-level events: project_id is null unless the token was confined to one project, in which case it names that project.
Background
Example envelope
{
"id": "evt_01K8QD4N3M7Y2K4N6P9R1T3V90",
"type": "token.created",
"created_at": "2026-11-04T08:30:00+00:00",
"api_version": "2026-11-01",
"project_id": null,
"data": {
"abilities": ["project:view-any", "project:view", "activity:read"],
"expires_at": null,
"name": "Nightly report",
"token_id": "1902",
"user_id": "2a91c4e7-6f38-4b52-8e0d-9c1a7b3f5d80"
}
}The plaintext token is never carried by an event. token_id is the token's integer id serialised as a string, the one identifier in the platform that is not a UUID.
Required ability
Tokens subscribing to token.* events need token:view at mint time.
Events
How is this guide?
Last updated on