# Get OAuth tokens

Retrieves the account's live OAuth tokens: those whose row is not revoked, including tokens whose access half has expired, because a `refreshable` one can be exchanged for a new access token until the row is revoked -- a refresh token never expires. Administrators only, authenticated by an apikey or a session; an OAuth bearer token is refused. Token and refresh token strings are never returned.
Requires the `eng-lc-oauth-token-management` launch control flag on the account.
The response is always paged. `sorted_by` accepts `created_at:asc` and `created_at:desc`; without it the page is ordered by `id` ascending.
A client that still holds a token revokes it itself at `POST /oauth/revoke` (RFC 7009), which needs no administrator.

Endpoint: GET /oauth_token/list
Version: 3
Security: ApiKeyAuth

## Query parameters:

  - `user_id` (integer)
    only list the tokens owned by this user. An empty value is no filter at all; a value that is not a plain decimal id, or that names a user outside the account, matches nothing rather than being an error

  - `page[size]` (integer)
    Max number of results.

  - `page[after]` (string)
    Cursor for the current page. If omitted, the first page is returned.
It must be a Base64-encoded JSON string, including an object with a single entry.
For example, the cursor `eyJpZCI6IjEyMyJ9` is decoded to `{"id":"123"}`.

  - `sorted_by` (string)
    Sort order for the results. If omitted, the default sort order is applied.
Format: `<key>:asc` or `<key>:desc`

## Response 200 fields (application/json):

  - `oauth_tokens` (array, required)

  - `oauth_tokens.id` (integer, required)
    unique identifier of the token
    Example: 123

  - `oauth_tokens.client` (any, required)
    the OAuth client the token was issued to. `null` for a token issued without a client

  - `oauth_tokens.client.id` (integer, required)
    unique identifier of the client
    Example: 456

  - `oauth_tokens.client.name` (string, required)
    the name of the client

  - `oauth_tokens.created_at` (string, required)
    when the token was issued

  - `oauth_tokens.expired` (boolean, required)
    whether the access half has expired. An expired token is still listed, because a `refreshable` one can be exchanged for a new access token until the row is revoked -- a refresh token never expires

  - `oauth_tokens.expires_at` (string, required)
    when the access half expires. `null` for a token that never expires

  - `oauth_tokens.refreshable` (boolean, required)
    whether the token carries a refresh token

  - `oauth_tokens.scopes` (string, required)
    the scopes granted to the token, space separated

  - `oauth_tokens.sub_user` (boolean, required)
    whether the owner is a sub user

  - `oauth_tokens.user` (any, required)
    the user the token was issued on behalf of. `null` when the user no longer resolves

  - `oauth_tokens.user.id` (integer, required)
    unique identifier of the user
    Example: 123

  - `oauth_tokens.user.email` (string, required)
    the email of the user

  - `oauth_tokens.user.name` (string, required)
    the display name of the user

  - `pagination` (object, required)
    Pagination metadata.

  - `pagination.next_page` (string, required)
    URL to the next page. `null` means there is no next page.
    Example: /resources?page[after]=eyJpZCI6IjEyMyJ9