List the fine-grained access tokens that act on an organization, all of them for an approver and only the own ones for another member

GET

/orgs/{org}/personal-access-tokens

curl --request GET \
  --url https://gitea.example.com/api/v1/orgs/example/personal-access-tokens \
  --header 'Authorization: Basic <credentials>'

Gitea Enterprise only. This endpoint is not part of the community edition.

Authorizations

• BasicAuth
• Token
• AccessToken
• AuthorizationHeaderToken
• SudoParam
• SudoHeader
• TOTPHeader

Parameters

Path Parameters

org

required

string

Name of the organization

Query Parameters

q

string

Filter by token name

status

string

Only tokens with this approval status (pending, approved, denied, revoked); a token without a request is pending

page

integer

Page number of results to return (1-based)

limit

integer

Page size of results

Responses

200

OrgAccessTokenList

Media typeapplication/json

Array<object>

OrgAccessToken is a fine-grained token that acts on an organization, as an owner of it sees the token.

It never carries the secret.

object

created_at

The moment the token was created

string format: date-time

description

The description the holder gave the token

string

expires_at

The moment the token stops working, absent when it never does

string format: date-time

holder

The user who holds the token

string

id

The unique identifier of the token

integer format: int64

justification

What the holder gave as the reason for the request

string

last_used_at

The moment the token was last used

string format: date-time

name

The name of the token

string

repo_selection

The repository selection: public, all or selected

string

repositories

The selected repositories as owner/name

Array<string>

scopes

The permissions of the token

Array<string>

status

The approval status: pending, approved, denied or revoked; a token without a request is pending

string

Example^generated

[
  {
    "created_at": "2026-04-15T12:00:00Z",
    "description": "example",
    "expires_at": "2026-04-15T12:00:00Z",
    "holder": "example",
    "id": 1,
    "justification": "example",
    "last_used_at": "2026-04-15T12:00:00Z",
    "name": "example",
    "repo_selection": "example",
    "repositories": [
      "example"
    ],
    "scopes": [
      "example"
    ],
    "status": "example"
  }
]

403

APIForbiddenError is a forbidden error response

Headers

message

string

url

string

404

APINotFound is a not found empty response