get /token

Get token

Alias endpoint; returns the element of the currently used token. This is equivalent to GET /<uuid> for the token’s own id, and is useful when that id is not yet known.

To list all tokens of the current user, request the root elements and filter for the Token type instead.

Note: Unlike most other endpoints, this one requires a token: calling it without one (i.e. as the default anonymous user) returns 403 Forbidden rather than 401 Unauthorized. An invalid or expired token still results in 401 Unauthorized.

Request

curl \
  -H 'Authorization: Bearer secret-token:PIPeJGUt7c00ENn8a5uDlc' \
  https://api.example.com/token
import requests


url = "https://api.example.com/token"


headers = {"Authorization": "Bearer secret-token:PIPeJGUt7c00ENn8a5uDlc"}


response = requests.get(url, headers=headers)


print(response.json())
const url = 'https://api.example.com/token';
const options = {
  method: 'GET',
  headers: {Authorization: 'Bearer secret-token:PIPeJGUt7c00ENn8a5uDlc'}
};


try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
<?php


$client = new \GuzzleHttp\Client();


$response = $client->request('GET', 'https://api.example.com/token', [
  'headers' => [
    'Authorization' => 'Bearer secret-token:PIPeJGUt7c00ENn8a5uDlc',
  ],
]);


echo $response->getBody();

Response

200 · OK

Token found. Returns a node.

MDN HTTP.dev 

304 · Not Modified

Not modified. Returned when If-None-Match header matches current ETag.

MDN HTTP.dev 

401 · Unauthorized

The provided token is either invalid or expired.

MDN HTTP.dev 

412 · Precondition Failed

Precondition failed. If-Match or If-None-Match condition not met.

MDN HTTP.dev 
{
  "type": "Token",
  "id": "74a8fcd9-6cb0-4b0d-8d42-0b6c3c54d1ac",
  "data": {
    "created": "2025-09-27T10:39:51+00:00",
    "updated": "2025-09-27T10:39:51+00:00",
    "name": "Blue",
    "content": "Blue is one of the three primary colours in the RYB colour model...\n"
  }
}
Access-Control-Allow-Headers: Authorization, Origin, X-Requested-With, Content-Type, Accept, Access-Control-Request-Method
Access-Control-Allow-Methods: GET, HEAD, POST, OPTIONS, PUT, PATCH, DELETE, PROPFIND, PROPPATCH, MKCOL, COPY, MOVE, LOCK, UNLOCK
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: ETag, Location
Allow: GET, HEAD, POST, OPTIONS, PUT, PATCH, DELETE, PROPFIND, PROPPATCH, MKCOL, COPY, MOVE, LOCK, UNLOCK
Cache-Control: no-cache, private
ETag: "YgbFC4u5EgC"
X-Powered-By: Ember Nexus API
{
  "type": "object",
  "required": [
    "type",
    "id",
    "data"
  ],
  "properties": {
    "type": {
      "type": "string",
      "example": "Data"
    },
    "id": {
      "type": "string",
      "format": "uuid",
      "example": "00000000-0000-0000-0000-000000000000",
      "description": "Global unique identifier for any element"
    },
    "data": {
      "type": "object",
      "additionalProperties": true,
      "example": {
        "created": "2025-09-27T10:39:51+00:00",
        "updated": "2025-09-27T10:39:51+00:00",
        "name": "some name"
      }
    },
    "file": {
      "type": "object",
      "additionalProperties": true,
      "readOnly": true,
      "example": {
        "contentLength": 63933,
        "extension": "jpg",
        "mimeType": "image/jpeg"
      }
    },
    "start": {
      "type": "string",
      "format": "uuid",
      "example": "00000000-0000-0000-0000-000000000000",
      "description": "Global unique identifier for any element"
    },
    "end": {
      "type": "string",
      "format": "uuid",
      "example": "00000000-0000-0000-0000-000000000000",
      "description": "Global unique identifier for any element"
    }
  }
}

response has no body

Access-Control-Allow-Headers: Authorization, Origin, X-Requested-With, Content-Type, Accept, Access-Control-Request-Method
Access-Control-Allow-Methods: GET, HEAD, POST, OPTIONS, PUT, PATCH, DELETE, PROPFIND, PROPPATCH, MKCOL, COPY, MOVE, LOCK, UNLOCK
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: ETag, Location
Allow: GET, HEAD, POST, OPTIONS, PUT, PATCH, DELETE, PROPFIND, PROPPATCH, MKCOL, COPY, MOVE, LOCK, UNLOCK
Cache-Control: no-cache, private
ETag: "YgbFC4u5EgC"
X-Powered-By: Ember Nexus API

no schema available

{
  "type": "https://api.example.com/error/401/unauthorized",
  "title": "Unauthorized",
  "status": 401,
  "detail": "Authorization for the request failed due to possible problems with the token (incorrect or expired), password (incorrect or changed), the user's unique identifier, or the user's status (e.g., missing, blocked, or deleted)."
}
Access-Control-Allow-Headers: Authorization, Origin, X-Requested-With, Content-Type, Accept, Access-Control-Request-Method
Access-Control-Allow-Methods: GET, HEAD, POST, OPTIONS, PUT, PATCH, DELETE, PROPFIND, PROPPATCH, MKCOL, COPY, MOVE, LOCK, UNLOCK
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: ETag, Location
Allow: GET, HEAD, POST, OPTIONS, PUT, PATCH, DELETE, PROPFIND, PROPPATCH, MKCOL, COPY, MOVE, LOCK, UNLOCK
Cache-Control: no-cache, private
X-Powered-By: Ember Nexus API
{
  "$schema": "https://spec.openapis.org/oas/3.0/schema/2021-09-28#/definitions/Schema",
  "type": "object",
  "description": "RFC 7807 Problem Details object.",
  "properties": {
    "type": {
      "type": "string",
      "format": "uri"
    },
    "title": {
      "type": "string"
    },
    "status": {
      "type": "integer"
    },
    "detail": {
      "type": "string"
    }
  }
}
{
  "type": "https://api.example.com/error/412/precondition-failed",
  "title": "Precondition Failed",
  "status": 412,
  "detail": "Precondition does not match."
}
Access-Control-Allow-Headers: Authorization, Origin, X-Requested-With, Content-Type, Accept, Access-Control-Request-Method
Access-Control-Allow-Methods: GET, HEAD, POST, OPTIONS, PUT, PATCH, DELETE, PROPFIND, PROPPATCH, MKCOL, COPY, MOVE, LOCK, UNLOCK
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: ETag, Location
Allow: GET, HEAD, POST, OPTIONS, PUT, PATCH, DELETE, PROPFIND, PROPPATCH, MKCOL, COPY, MOVE, LOCK, UNLOCK
Cache-Control: no-cache, private
X-Powered-By: Ember Nexus API
{
  "$schema": "https://spec.openapis.org/oas/3.0/schema/2021-09-28#/definitions/Schema",
  "type": "object",
  "description": "RFC 7807 Problem Details object.",
  "properties": {
    "type": {
      "type": "string",
      "format": "uri"
    },
    "title": {
      "type": "string"
    },
    "status": {
      "type": "integer"
    },
    "detail": {
      "type": "string"
    }
  }
}

Request Header

Authorization

optional

Bearer token for user authentication. If omitted, the request is processed as an anonymous user; if provided, the associated user account is used.

MDN HTTP.dev Authentication guide 

If-Match

optional

Used primarily for optimistic concurrency control — the request is only executed if the resource's ETag matches the provided value.

MDN HTTP.dev Caching guide 

If-None-Match

optional

Used primarily for caching — skips re-downloading an unchanged resource by returning 304 Not Modified if the resource's ETag matches the provided value.

MDN HTTP.dev Caching guide 

Response Header

ETag

always

Entity tag used for caching and optimistic concurrency control.

MDN HTTP.dev Caching guide 

Access-Control-Allow-Headers

always

Specifies which HTTP headers can be used during a cross-origin request, returned in preflight responses.

MDN HTTP.dev 

Access-Control-Allow-Methods

always

Indicates which HTTP methods are permitted for cross-origin requests, typically returned in preflight responses.

MDN HTTP.dev 

Access-Control-Allow-Origin

always

Specifies which origin(s) may access the resource.

MDN HTTP.dev 

Access-Control-Expose-Headers

always

Lists the response headers that browsers are allowed to access from JavaScript beyond the default restricted set.

MDN HTTP.dev 

Allow

always

Lists the HTTP methods supported by the endpoint; returned alongside a 405 Method Not Allowed response.

MDN HTTP.dev 

Cache-Control

always

Directives controlling caching behavior for the response.

MDN HTTP.dev 

X-Powered-By

always

Identifies the underlying API implementation.

MDN HTTP.dev