Skip to main content

Access tokens

Base URL: https://events.pana.space/api

Workspace personal access tokens (PAT) let server-side integrations call the API without a user session.

Requires: workspace admin role.

Base path:

/api/v1/{workspace_id}/developers/access-tokens/

List tokens​

GET /api/v1/{workspace_id}/developers/access-tokens/
Authorization: Bearer <jwt_or_pat>

Response (token secret not included):

[
  {
    "id": "uuid",
    "name": "Production integration",
    "token_prefix": "pat_a1b2c3d4",
    "is_active": true,
    "last_used_at": "2026-06-20T10:00:00Z",
    "created_at": "2026-06-01T09:00:00Z",
    "created_by_name": "Jane Doe",
    "created_by_email": "jane@example.com",
    "created_by_avatar": "https://…"
  }
]

Create token​

POST /api/v1/{workspace_id}/developers/access-tokens/
Authorization: Bearer <jwt>
Content-Type: application/json

{
  "name": "CI pipeline"
}

Response (201 Created):

{
  "id": "uuid",
  "name": "CI pipeline",
  "token_prefix": "pat_a1b2c3d4",
  "token": "pat_a1b2c3d4e5f6789…",
  "is_active": true,
  "created_at": "2026-06-20T10:00:00Z",
  "created_by_name": "Jane Doe"
}

The token field is returned only once. Store it immediately.

Revoke token​

DELETE /api/v1/{workspace_id}/developers/access-tokens/{token_id}/
Authorization: Bearer <jwt>

Soft-deactivates the token (204 No Content).

Using a PAT​

GET /api/v1/{workspace_id}/leads/
Authorization: Bearer pat_a1b2c3d4e5f6789…

Rules:

  • PAT must belong to the same {workspace_id} in the URL
  • Owner must be an active workspace member
  • Invalid/revoked PAT → 401

PAT works on standard workspace APIs (events, leads, forms, etc.) — same as JWT for permitted roles.

Security​

  • Tokens are stored as SHA-256 hashes — only the prefix is kept for display
  • Rotate tokens by creating a new one and deleting the old one
  • Never commit tokens to git or expose in client-side code