Kong Personal Access Tokens API

openapi: 3.2.0
info:
  title: Konnect API - Go SDK Personal Access Tokens API
  version: 3.14.0
  description: The Konnect platform API
  contact:
    name: Kong Inc
    url: https://konghq.com
    email: support@konghq.com
  x-extensions-note: "This API uses the `x-expression` vendor extension to indicate that a string property is a DSL expression.\nSupported types:\n\n\n  - `boolean`: An expression evaluates to boolean. For example, `context.topic.name == 'my-topic'`\n  - `string`: A template string expression that evaluates to a string or a literal string value. For example,\n    `${context.topic.name.substring(0, context.topic.name.length-4)}` or `my-literal-value`\n\nAdditionally, `x-sensitive` flag indicates that a field contains sensitive information. When the value\nof the field is provided in plain text, it's encrypted at rest and it's never returned in API responses.\nWhen the value is an expression, the expression itself is stored and returned in API responses.\n\n`x-min-runtime-version` indicates the minimum Event Gateway runtime version required to use a certain policy or\npolicy feature. The runtime version can be configured at the Event Gateway entity level. It must be a string\ncontaining a semantic version in the `MAJOR.MINOR` format, e.g., `\"1.1\"`.\n"
  license:
    name: Apache 2.0
    url: https://www.apache.org/licenses/LICENSE-2.0.html
  x-oas-source: kong/platform-api@
  x-oas-source-link: https://github.com/Kong/platform-api/commit/
servers:
- url: https://global.api.konghq.com
- url: https://us.api.konghq.com
- url: https://eu.api.konghq.com
- url: https://au.api.konghq.com
security:
- personalAccessToken: []
- systemAccountAccessToken: []
- konnectAccessToken: []
- serviceAccessToken: []
tags:
- name: Personal Access Tokens
paths:
  /v3/users/{userId}/access-tokens:
    parameters:
    - $ref: '#/components/parameters/userId'
    get:
      operationId: list-users-personal-access-tokens
      summary: List PATs
      description: List personal access tokens for a user.
      responses:
        '200':
          $ref: '#/components/responses/PersonalAccessTokenListResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/responses-Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
      security:
      - personalAccessToken: []
      - konnectAccessToken: []
      - serviceAccessToken: []
      servers:
      - url: https://global.api.konghq.com/
      tags:
      - Personal Access Tokens
    post:
      operationId: create-personal-access-token
      summary: Create a new personal access token
      description: Create a new personal access token. A maximum of 10 personal access tokens can be created.
      requestBody:
        $ref: '#/components/requestBodies/PersonalAccessTokenCreateRequest'
      responses:
        '201':
          $ref: '#/components/responses/PersonalAccessTokenCreateResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/responses-Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
      security:
      - personalAccessToken: []
      - konnectAccessToken: []
      servers:
      - url: https://global.api.konghq.com/
      tags:
      - Personal Access Tokens
  /v3/users/{userId}/access-tokens/{tokenId}:
    parameters:
    - $ref: '#/components/parameters/userId'
    - name: tokenId
      in: path
      description: ID of the personal access token.
      required: true
      schema:
        $ref: '#/components/schemas/UUID'
    get:
      operationId: get-personal-access-token-details
      summary: Get Personal Access Token details
      description: Get Personal Access Token details.
      responses:
        '200':
          $ref: '#/components/responses/PersonalAccessTokenResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/responses-Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
      security:
      - personalAccessToken: []
      - konnectAccessToken: []
      - serviceAccessToken: []
      servers:
      - url: https://global.api.konghq.com/
      tags:
      - Personal Access Tokens
    patch:
      operationId: update-personal-access-token-details
      summary: Update personal access token details
      description: Update personal access token details.
      requestBody:
        $ref: '#/components/requestBodies/PersonalAccessTokenUpdateRequest'
      responses:
        '200':
          $ref: '#/components/responses/PersonalAccessTokenResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/responses-Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
      security:
      - personalAccessToken: []
      - konnectAccessToken: []
      servers:
      - url: https://global.api.konghq.com/
      tags:
      - Personal Access Tokens
    delete:
      operationId: delete-personal-access-token
      summary: Delete personal access token
      description: Delete personal access token.
      responses:
        '204':
          description: No Content
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/responses-Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
      security:
      - personalAccessToken: []
      - konnectAccessToken: []
      servers:
      - url: https://global.api.konghq.com/
      tags:
      - Personal Access Tokens
  /v3/users/{userId}/access-tokens/{tokenId}/revoke:
    parameters:
    - $ref: '#/components/parameters/userId'
    - name: tokenId
      in: path
      description: ID of the personal access token.
      required: true
      schema:
        $ref: '#/components/schemas/UUID'
    patch:
      operationId: revoke-personal-access-token
      summary: Revoke Personal Access Token
      description: Revoke Personal Access Token.
      responses:
        '200':
          $ref: '#/components/responses/PersonalAccessTokenResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/responses-Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
      security:
      - personalAccessToken: []
      - konnectAccessToken: []
      - serviceAccessToken: []
      servers:
      - url: https://global.api.konghq.com/
      tags:
      - Personal Access Tokens
components:
  schemas:
    PATName:
      type: string
      maxLength: 256
      minLength: 1
      pattern: ^[\p{L}\p{N}][\p{L}\p{N} _\-\.']*[\p{L}\p{N}]$
    BadRequestError:
      allOf:
      - $ref: '#/components/schemas/BaseError'
      - type: object
        required:
        - invalid_parameters
        properties:
          invalid_parameters:
            $ref: '#/components/schemas/InvalidParameters'
    BaseError:
      description: standard error
      type: object
      properties:
        status:
          description: 'The HTTP status code of the error. Useful when passing the response

            body to child properties in a frontend UI. Must be returned as an integer.

            '
          type: integer
          readOnly: true
        title:
          description: 'A short, human-readable summary of the problem. It should not

            change between occurences of a problem, except for localization.

            Should be provided as "Sentence case" for direct use in the UI.

            '
          type: string
          readOnly: true
        type:
          description: The error type.
          type: string
          readOnly: true
        instance:
          description: 'Used to return the correlation ID back to the user, in the format

            kong:trace:<correlation_id>. This helps us find the relevant logs

            when a customer reports an issue.

            '
          type: string
          readOnly: true
        detail:
          description: 'A human readable explanation specific to this occurence of the problem.

            This field may contain request/entity data to help the user understand

            what went wrong. Enclose variable values in square brackets. Should be

            provided as "Sentence case" for direct use in the UI.

            '
          type: string
          readOnly: true
      required:
      - status
      - title
      - instance
      - detail
      title: Error
    InvalidParameterMinimumLength:
      type: object
      properties:
        field:
          type: string
          example: name
          readOnly: true
        rule:
          description: invalid parameters rules
          type: string
          enum:
          - min_length
          - min_digits
          - min_lowercase
          - min_uppercase
          - min_symbols
          - min_items
          - min
          nullable: false
          readOnly: true
          x-speakeasy-unknown-values: allow
        minimum:
          type: integer
          example: 8
        source:
          type: string
          example: body
        reason:
          type: string
          example: must have at least 8 characters
          readOnly: true
      additionalProperties: false
      required:
      - field
      - reason
      - rule
      - minimum
    UpdatedAt:
      description: An ISO-8601 timestamp representation of entity update date.
      type: string
      format: date-time
      example: '2022-11-04T20:10:06.927Z'
      readOnly: true
      x-speakeasy-param-suppress-computed-diff: true
    LastUsedAt:
      description: An ISO-8601 timestamp representation of entity last used date.
      type: string
      format: date-time
      example: '2022-11-04T20:10:06.927Z'
      nullable: true
      readOnly: true
      x-speakeasy-param-suppress-computed-diff: true
    CreatedAt:
      description: An ISO-8601 timestamp representation of entity creation date.
      type: string
      format: date-time
      example: '2022-11-04T20:10:06.927Z'
      readOnly: true
      x-speakeasy-param-suppress-computed-diff: true
    UserId:
      description: Contains a unique identifier used for a user.
      type: string
      format: uuid
      example: 5f9fd312-a987-4628-b4c5-bb4f4fddd5f7
      readOnly: true
    UUID:
      description: Contains a unique identifier used for this resource.
      type: string
      format: uuid
      example: 5f9fd312-a987-4628-b4c5-bb4f4fddd5f7
      readOnly: true
    ExpiresAt:
      description: An ISO-8601 timestamp representation of entity expiration date.
      type: string
      format: date-time
      example: '2022-11-04T20:10:06.927Z'
      nullable: true
      readOnly: true
      x-speakeasy-param-suppress-computed-diff: true
    UnauthorizedError:
      allOf:
      - $ref: '#/components/schemas/BaseError'
      - type: object
        properties:
          status:
            example: 401
          title:
            example: Unauthorized
          type:
            example: https://httpstatuses.com/401
          instance:
            example: kong:trace:1234567890
          detail:
            example: Invalid credentials
    RevokedAt:
      description: An ISO-8601 timestamp representation of entity revoked at date.
      type: string
      format: date-time
      example: '2022-11-04T20:10:06.927Z'
      nullable: true
      readOnly: true
      x-speakeasy-param-suppress-computed-diff: true
    NotFoundError:
      allOf:
      - $ref: '#/components/schemas/BaseError'
      - type: object
        properties:
          status:
            example: 404
          title:
            example: Not Found
          type:
            example: https://httpstatuses.com/404
          instance:
            example: kong:trace:1234567890
          detail:
            example: Not found
    PersonalAccessTokenState:
      description: State of the personal access token.
      type: string
      enum:
      - ACTIVE
      - REVOKED
      - EXPIRED
      x-speakeasy-unknown-values: allow
    InvalidParameterMaximumLength:
      type: object
      properties:
        field:
          type: string
          example: name
          readOnly: true
        rule:
          description: invalid parameters rules
          type: string
          enum:
          - max_length
          - max_items
          - max
          nullable: false
          readOnly: true
          x-speakeasy-unknown-values: allow
        maximum:
          type: integer
          example: 8
        source:
          type: string
          example: body
        reason:
          type: string
          example: must not have more than 8 characters
          readOnly: true
      additionalProperties: false
      required:
      - field
      - reason
      - rule
      - maximum
    InvalidParameterStandard:
      type: object
      properties:
        field:
          type: string
          example: name
          readOnly: true
        rule:
          $ref: '#/components/schemas/InvalidRules'
        source:
          type: string
          example: body
        reason:
          type: string
          example: is a required field
          readOnly: true
      additionalProperties: false
      required:
      - field
      - reason
    PageMeta:
      description: Contains pagination query parameters and the total number of objects returned.
      type: object
      properties:
        number:
          type: number
          example: 1
          x-speakeasy-terraform-ignore: true
        size:
          type: number
          example: 10
          x-speakeasy-terraform-ignore: true
        total:
          type: number
          example: 100
          x-speakeasy-terraform-ignore: true
      required:
      - number
      - size
      - total
    InvalidParameterChoiceItem:
      type: object
      properties:
        field:
          type: string
          example: name
          readOnly: true
        rule:
          description: invalid parameters rules
          type: string
          enum:
          - enum
          nullable: false
          readOnly: true
        reason:
          type: string
          example: is a required field
          readOnly: true
        choices:
          type: array
          items: {}
          minItems: 1
          nullable: false
          readOnly: true
          uniqueItems: true
        source:
          type: string
          example: body
      additionalProperties: false
      required:
      - field
      - reason
      - rule
      - choices
    PersonalAccessTokenCreateRequestWithExpiresAt:
      description: '**Deprecated:** Use `ttl_seconds` instead of `expires_at` to specify token expiration. Using a time-to-live value avoids clock skew issues when setting token expiration.'
      type: object
      properties:
        name:
          $ref: '#/components/schemas/PATName'
        expires_at:
          description: An ISO-8601 timestamp representation of entity expiration date.
          type: string
          format: date-time
          example: '2022-11-04T20:10:06.927Z'
          readOnly: false
          x-speakeasy-param-suppress-computed-diff: true
      additionalProperties: false
      deprecated: true
      required:
      - name
      - expires_at
    PersonalAccessTokenCreateResponse:
      description: Details of the created personal access token.
      type: object
      properties:
        id:
          $ref: '#/components/schemas/UUID'
        user_id:
          $ref: '#/components/schemas/UserId'
        name:
          type: string
        state:
          description: State of the personal access token.
          type: string
          enum:
          - ACTIVE
          - REVOKED
          - EXPIRED
          readOnly: true
          x-speakeasy-unknown-values: allow
        konnect_token:
          description: The Konnect token used to authenticate with Konnect.
          type: string
        revoked_by:
          $ref: '#/components/schemas/RevokedBy'
        created_at:
          $ref: '#/components/schemas/CreatedAt'
        updated_at:
          $ref: '#/components/schemas/UpdatedAt'
        last_used_at:
          $ref: '#/components/schemas/LastUsedAt'
        expires_at:
          $ref: '#/components/schemas/ExpiresAt'
        revoked_at:
          $ref: '#/components/schemas/RevokedAt'
      required:
      - id
      - name
      - state
      - konnect_token
      - user_id
      - created_at
      - expires_at
    PersonalAccessTokenCreateRequestWithTTL:
      type: object
      properties:
        name:
          $ref: '#/components/schemas/PATName'
        ttl_seconds:
          description: The time to live in seconds for the personal access token.
          type: integer
          maximum: 31536000
          minimum: 86400
      additionalProperties: false
      required:
      - name
      - ttl_seconds
    InvalidParameters:
      description: invalid parameters
      type: array
      items:
        oneOf:
        - $ref: '#/components/schemas/InvalidParameterStandard'
        - $ref: '#/components/schemas/InvalidParameterMinimumLength'
        - $ref: '#/components/schemas/InvalidParameterMaximumLength'
        - $ref: '#/components/schemas/InvalidParameterChoiceItem'
        - $ref: '#/components/schemas/InvalidParameterDependentItem'
      minItems: 1
      nullable: false
      uniqueItems: true
    RevokedBy:
      description: Contains a unique identifier used for the user that revoked this token.
      type: string
      format: uuid
      example: 5f9fd312-a987-4628-b4c5-bb4f4fddd5f7
      nullable: true
      readOnly: true
    ConflictError:
      allOf:
      - $ref: '#/components/schemas/BaseError'
      - type: object
        properties:
          status:
            example: 409
          title:
            example: Conflict
          type:
            example: https://httpstatuses.com/409
          instance:
            example: kong:trace:1234567890
          detail:
            example: Conflict
    ForbiddenError:
      allOf:
      - $ref: '#/components/schemas/BaseError'
      - type: object
        properties:
          status:
            example: 403
          title:
            example: Forbidden
          type:
            example: https://httpstatuses.com/403
          instance:
            example: kong:trace:1234567890
          detail:
            example: Forbidden
    InvalidParameterDependentItem:
      type: object
      properties:
        field:
          type: string
          example: name
          readOnly: true
        rule:
          description: invalid parameters rules
          type: string
          enum:
          - dependent_fields
          nullable: true
          readOnly: true
        reason:
          type: string
          example: is a required field
          readOnly: true
        dependents:
          type: array
          items: {}
          nullable: true
          readOnly: true
          uniqueItems: true
        source:
          type: string
          example: body
      additionalProperties: false
      required:
      - field
      - rule
      - reason
      - dependents
    PersonalAccessToken:
      description: Properties of a personal access token.
      type: object
      properties:
        id:
          $ref: '#/components/schemas/UUID'
        user_id:
          $ref: '#/components/schemas/UserId'
        name:
          type: string
        state:
          $ref: '#/components/schemas/PersonalAccessTokenState'
        revoked_by:
          $ref: '#/components/schemas/RevokedBy'
        created_at:
          $ref: '#/components/schemas/CreatedAt'
        updated_at:
          $ref: '#/components/schemas/UpdatedAt'
        last_used_at:
          $ref: '#/components/schemas/LastUsedAt'
        expires_at:
          $ref: '#/components/schemas/ExpiresAt'
        revoked_at:
          $ref: '#/components/schemas/RevokedAt'
      additionalProperties: false
      required:
      - id
      - name
      - state
      - user_id
      - created_at
      - updated_at
      - expires_at
    InvalidRules:
      description: invalid parameters rules
      type: string
      enum:
      - required
      - is_array
      - is_base64
      - is_boolean
      - is_date_time
      - is_integer
      - is_null
      - is_number
      - is_object
      - is_string
      - is_uuid
      - is_fqdn
      - is_arn
      - unknown_property
      - missing_reference
      - is_label
      - matches_regex
      - invalid
      - is_supported_network_availability_zone_list
      - is_supported_network_cidr_block
      - is_supported_provider_region
      - type
      nullable: true
      readOnly: true
      x-speakeasy-unknown-values: allow
  responses:
    PersonalAccessTokenListResponse:
      description: A list response for a collection of personal access tokens.
      content:
        application/json:
          schema:
            type: object
            properties:
              meta:
                $ref: '#/components/schemas/PageMeta'
              data:
                type: array
                items:
                  $ref: '#/components/schemas/PersonalAccessToken'
            additionalProperties: false
            required:
            - data
    BadRequest:
      description: Bad Request
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/BadRequestError'
    PersonalAccessTokenResponse:
      description: Response containing details of a personal access token.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/PersonalAccessToken'
    Forbidden:
      description: Forbidden
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/ForbiddenError'
    responses-Unauthorized:
      description: Unauthorized
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/UnauthorizedError'
    Conflict:
      description: Conflict
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/ConflictError'
    PersonalAccessTokenCreateResponse:
      description: Response containing details of the created personal access token.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/PersonalAccessTokenCreateResponse'
    NotFound:
      description: Not Found
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/NotFoundError'
  parameters:
    userId:
      name: userId
      in: path
      required: true
      description: ID of the user.
      x-go-name: userIdParam
      schema:
        $ref: '#/components/schemas/UUID'
  requestBodies:
    PersonalAccessTokenCreateRequest:
      description: Request body schema for creating personal access tokens.
      content:
        application/json:
          schema:
            oneOf:
            - $ref: '#/components/schemas/PersonalAccessTokenCreateRequestWithExpiresAt'
            - $ref: '#/components/schemas/PersonalAccessTokenCreateRequestWithTTL'
    PersonalAccessTokenUpdateRequest:
      description: Request body schema for updating personal access tokens.
      content:
        application/json:
          schema:
            type: object
            properties:
              name:
                $ref: '#/components/schemas/PATName'
            minProperties: 1
  securitySchemes:
    personalAccessToken:
      type: http
      scheme: bearer
      bearerFormat: Token
      description: The personal access token is meant to be used as an alternative to basic-auth when accessing Konnect via APIs. You can generate a Personal Access Token (PAT) from the personal access token page in the Konnect dashboard.
    systemAccountAccessToken:
      type: http
      scheme: bearer
      bearerFormat: Token
      description: 'The system account access token is meant for automations and integrations that are not directly associated with a human identity.

        You can generate a system account Access Token by creating a system account and then obtaining a system account access token for that account.

        The access token must be passed in the header of a request, for example:

        `curl -X GET ''https://global.api.konghq.com/v2/users/'' --header ''Authorization: Bearer spat_i2Ej...''`

        '
    konnectAccessToken:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: The Konnect access token is meant to be used by the Konnect dashboard and the decK CLI to authenticate with.
    serviceAccessToken:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: 'The Service access token is meant to be used between internal services.

        '
externalDocs:
  description: Documentation for Kong Gateway and its APIs
  url: https://developer.konghq.com