Sonatype Nexus Repository Security management: user tokens API

openapi: 3.2.0
info:
  title: 'Nexus Repository Manager REST Security management: user…'
  version: 3.97.2-02
servers:
- url: /service/rest
tags:
- name: 'Security management: user tokens'
paths:
  /v1/security/user-tokens/tokens:
    get:
      tags:
      - 'Security management: user tokens'
      summary: List user tokens or look up a token owner by nameCode
      description: 'Without ''nameCode'': lists all tokens with optional realm/userId filters and pagination. Returns metadata only — passCode is never returned. With ''nameCode'': switches to single-token lookup mode. Returns a single UserTokenXO (200) if the nameCode exists (expired tokens included), or 404 if not found. The userId, includeExpired, skip, and limit parameters are ignored in lookup mode.'
      operationId: listSecurityUserTokensTokens
      parameters:
      - name: realm
        in: query
        description: Filter by realm (optional). Also acts as a realm constraint in nameCode lookup mode.
        schema:
          type: string
      - name: userId
        in: query
        description: Filter by user ID (optional). Ignored when 'nameCode' is provided.
        schema:
          type: string
      - name: nameCode
        in: query
        description: Look up the token owner by nameCode. When present, the endpoint resolves a single token and returns 404 if not found. Expired tokens are always included in lookup results.
        schema:
          type: string
      - name: includeExpired
        in: query
        description: 'Include expired tokens in list results (default: false). Ignored in nameCode lookup mode — expired tokens are always included.'
        schema:
          type: boolean
      - name: skip
        in: query
        description: 'Number of items to skip for pagination (default: 0). Ignored in lookup mode.'
        schema:
          type: integer
          format: int32
      - name: limit
        in: query
        description: 'Maximum number of items to return (default: 25, max: 100). Ignored in lookup mode.'
        schema:
          type: integer
          format: int32
      responses:
        '200':
          description: Success. In list mode (no 'nameCode' param) returns UserTokenListXO. In lookup mode ('nameCode' present) returns a single UserTokenXO.
          content:
            application/json:
              schema:
                oneOf:
                - $ref: '#/components/schemas/UserTokenListXO'
                - $ref: '#/components/schemas/UserTokenXO'
        '400':
          description: Invalid request parameters, or user token capability is disabled.
        '403':
          description: Insufficient privileges to view or audit user tokens.
        '404':
          description: No user token found with the given nameCode. Only returned when 'nameCode' is provided.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SimpleApiResponse'
        '500':
          description: Unexpected server error. Please try again later.
  /v1/security/user-tokens:
    get:
      tags:
      - 'Security management: user tokens'
      summary: Show if the user token capability is enabled or not
      operationId: listSecurityUserTokens
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserTokensApiModel'
    put:
      tags:
      - 'Security management: user tokens'
      operationId: updateSecurityUserTokens
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UserTokensApiModel'
        required: true
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserTokensApiModel'
      summary: Update security user tokens
      x-summary-source: derived
    delete:
      tags:
      - 'Security management: user tokens'
      operationId: deleteSecurityUserTokens
      responses:
        '200':
          description: successful operation
          content:
            application/json: {}
      summary: Delete security user tokens
      x-summary-source: derived
components:
  schemas:
    UserTokensApiModel:
      type: object
      properties:
        enabled:
          type: boolean
          description: Whether or not User Tokens feature is enabled
        protectContent:
          type: boolean
          description: Additionally require user tokens for repository authentication
        expirationEnabled:
          type: boolean
          description: Enable user tokens expiration
        expirationDays:
          maximum: 999
          minimum: 1
          type: integer
          description: Set user token expiration days (E.g., 1-999)
          format: int32
          example: 30
    UserTokenXO:
      required:
      - created
      - nameCode
      type: object
      properties:
        userId:
          type: string
        realm:
          type: string
        nameCode:
          type: string
        passCode:
          type: string
        created:
          type: string
          format: date-time
        expires:
          type: string
          format: date-time
        isExpired:
          type: boolean
        createdByUserId:
          type: string
        createdByRealm:
          type: string
      xml:
        name: userToken
    UserTokenListXO:
      type: object
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/UserTokenXO'
        continuationToken:
          type: string
      xml:
        name: userTokenList
    SimpleApiResponse:
      type: object
      properties:
        status:
          type: integer
          format: int32
        message:
          type: string
        data:
          type: object