# 3pm-backend route `listTokens`

Paths are relative to the backend's origin (https://fleet.edgecr4ft.net, or your own 3pm-backend), not to this site. Index: https://3pm.edgecr4ft.net/docs/backend/api.md

---

tokens:
  claude: 409
  o200k: 260
# GET /api/buckets/{clusterId}/tokens (listTokens)

Every enrollment token of the bucket; never the secrets.

- auth: an account — Authorization: Bearer 3pmu_<token>, or the dashboard's session cookie
- answer: TokenView[] (JSON)

## Types

```ts
/** A token as listed: never the secret. */
interface TokenView {
  token_id: string;
  created_at: EpochMs;
  expires_at: EpochMs;
  uses_total: number;
  uses_left: number;
  /** The host it admits is active at once, with no approval step. */
  pre_approved: boolean;
  revoked_at?: EpochMs;
  state: TokenState;
  /** The bucket's permanent token (`bucketToken`): always `usable`, its `expires_at` and uses mean nothing, and `revokeToken` refuses it (409). */
  permanent?: boolean;
}

/** Milliseconds since the Unix epoch. */
type EpochMs = number;

/** `TokenView.state` at listing time. */
type TokenState = "usable" | "expired" | "exhausted" | "revoked";
```