List access tokens API Reference

GET

/tenants/{tenant}/registries/{name}/tokens

curl --request GET \
  --url 'https://api.kupe.cloud/api/v1/tenants/acme/registries/registry/tokens?kind=token' \
  --header 'Authorization: <Authorization>'

List the registry’s access tokens and login sessions, newest first. ?kind=token or ?kind=session lists one kind; without it, both. Secrets are never returned: a token’s secret is shown once, when it is created. username is the registry username once the token is issued (status.phase Ready). Every member can list. Served even while the platform has the registry switched off.

Authorizations

• BearerAuth

Parameters

Path Parameters

tenant

required

string

Tenant name

name

required

string

Registry name: always registry

Query Parameters

kind

string

Allowed values: token session

Token or session

Responses

200

Access tokens and login sessions

Media type application/json

object

items

Array<object>

object

access

Access is pull, or push (which includes pull).

string

Allowed values: pull push

createdAt

string

createdBy

CreatedBy is the email of the member who created it; it is revoked when they leave the tenant.

string

displayName

string

expiresAt

string

id

ID is rt- and 16 hex characters.

string

kind

Kind is token (an access token) or session (a login session from kupe registry login).

string

Allowed values: token session

lastUsedAt

LastUsedAt is when the token last pulled or pushed, empty if never; read hourly at most.

string

status

object

conditions

Array<object>

object

key

additional properties

message

Message gives detail while Pending or Failed; empty while Ready.

string

phase

Phase is Pending until the token is issued, then Ready; Failed means it can never work: create a new one.

string

Allowed values: Pending Ready Failed

username

Username is the registry username, empty until the token is issued (status.phase Ready).

string

Example

{
  "items": [
    {
      "access": "pull",
      "createdAt": "2026-10-21T10:00:00Z",
      "createdBy": "alice@acme.com",
      "displayName": "GitHub Actions",
      "expiresAt": "2027-01-19T10:00:00Z",
      "id": "rt-0a1b2c3d4e5f6a7b",
      "kind": "token",
      "lastUsedAt": "2026-10-21T11:00:00Z",
      "status": {
        "message": "",
        "phase": "Pending"
      },
      "username": "kupe+acme+tok-0a1b2c3d4e5f6a7b"
    }
  ]
}

400

Invalid name or kind

Media type application/json

object

code

string

error

string

field

string

message

string

severity

string

Example ^generated

{
  "code": "example",
  "error": "example",
  "field": "example",
  "message": "example",
  "severity": "example"
}

401

Missing or invalid authentication

Media type application/json

object

code

string

error

string

field

string

message

string

severity

string

Example ^generated

{
  "code": "example",
  "error": "example",
  "field": "example",
  "message": "example",
  "severity": "example"
}

403

Not a member of this tenant

Media type application/json

object

code

string

error

string

field

string

message

string

severity

string

Example ^generated

{
  "code": "example",
  "error": "example",
  "field": "example",
  "message": "example",
  "severity": "example"
}

404

Registry not found

Media type application/json

object

code

string

error

string

field

string

message

string

severity

string

Example ^generated

{
  "code": "example",
  "error": "example",
  "field": "example",
  "message": "example",
  "severity": "example"
}

429

Rate limit exceeded

Media type application/json

object

code

string

error

string

field

string

message

string

severity

string

Example ^generated

{
  "code": "example",
  "error": "example",
  "field": "example",
  "message": "example",
  "severity": "example"
}