Endpoint
List access tokens associated with your account. Returns metadata about the tokens (IDs, scopes, expiration) but not the actual token secrets.
This endpoint is not supported in s2-lite. Access token management is only available in S2 Cloud.
Query Parameters
Filter to access tokens whose IDs begin with this prefix. Use an empty string to match all tokens.
Filter to access tokens whose IDs lexicographically start after this string. Used for pagination.
Number of results to return, up to a maximum of 1000.
Response
List of access token information objects (up to 1000 items).Show AccessTokenInfo object
Access token ID. Must be unique to the account and between 1 and 96 bytes in length.
Expiration time in RFC 3339 format (e.g., 2027-01-01T00:00:00Z).
Whether stream names are automatically prefixed based on the stream-level scope.
Access token scope defining permissions.
Basin names allowed. Can be {"exact": "basin-name"} or {"prefix": "prefix-"}.
Stream names allowed. Can be {"exact": "stream-name"} or {"prefix": "prefix-"}.
Token IDs allowed for token management operations. Can be {"exact": "token-id"} or {"prefix": "prefix-"}.
Access permissions at operation group level.
Account-level access permissions with read and write boolean fields.
Basin-level access permissions with read and write boolean fields.
Stream-level access permissions with read and write boolean fields.
List of specific operations allowed for the token. Union of ops and op_groups is used as the effective set of allowed operations.
Indicates whether there are more access tokens that match the criteria.
Example
curl -X GET "https://aws.s2.dev/v1/access-tokens?limit=10" \
-H "Authorization: Bearer $S2_ACCESS_TOKEN"
{
"access_tokens": [
{
"id": "prod-api-token",
"expires_at": "2027-01-01T00:00:00Z",
"auto_prefix_streams": false,
"scope": {
"basins": {"prefix": "prod-"},
"streams": {"prefix": ""},
"op_groups": {
"stream": {
"read": true,
"write": true
}
},
"ops": []
}
},
{
"id": "prod-readonly-token",
"expires_at": "2026-12-31T23:59:59Z",
"auto_prefix_streams": false,
"scope": {
"basins": {"exact": "production"},
"streams": {"prefix": "logs/"},
"op_groups": {
"stream": {
"read": true,
"write": false
}
},
"ops": []
}
}
],
"has_more": false
}
- Make an initial request with your desired
limit
- If
has_more is true, make another request with start_after set to the last token ID from the previous response
- Repeat until
has_more is false
# First page
curl -X GET "https://aws.s2.dev/v1/access-tokens?limit=100" \
-H "Authorization: Bearer $S2_ACCESS_TOKEN"
# Next page (if has_more: true)
curl -X GET "https://aws.s2.dev/v1/access-tokens?limit=100&start_after=last-token-id" \
-H "Authorization: Bearer $S2_ACCESS_TOKEN"