API version: dev --- # GET /token — Get token Alias endpoint; returns the element of the currently used token. This is equivalent to `GET /` for the token's own `id`, and is useful when that `id` is not yet known. To list all tokens of the current user, request the root elements and filter for the `Token` type instead. **Note**: Unlike most other endpoints, this one requires a token: calling it without one (i.e. as the default anonymous user) returns `403 Forbidden` rather than `401 Unauthorized`. An invalid or expired token still results in `401 Unauthorized`. ## Request ```bash curl \ -H 'Authorization: Bearer secret-token:PIPeJGUt7c00ENn8a5uDlc' \ https://api.example.com/token ``` ## Response ### 200 · OK Token found. Returns a node. #### Body ```json { "type": "Token", "id": "74a8fcd9-6cb0-4b0d-8d42-0b6c3c54d1ac", "data": { "created": "2025-09-27T10:39:51+00:00", "updated": "2025-09-27T10:39:51+00:00", "name": "Blue", "content": "Blue is one of the three primary colours in the RYB colour model...\n" } } ``` #### Headers ```http Access-Control-Allow-Headers: Authorization, Origin, X-Requested-With, Content-Type, Accept, Access-Control-Request-Method Access-Control-Allow-Methods: GET, HEAD, POST, OPTIONS, PUT, PATCH, DELETE, PROPFIND, PROPPATCH, MKCOL, COPY, MOVE, LOCK, UNLOCK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: ETag, Location Allow: GET, HEAD, POST, OPTIONS, PUT, PATCH, DELETE, PROPFIND, PROPPATCH, MKCOL, COPY, MOVE, LOCK, UNLOCK Cache-Control: no-cache, private ETag: "YgbFC4u5EgC" X-Powered-By: Ember Nexus API ``` #### Schema ```json { "type": "object", "required": [ "type", "id", "data" ], "properties": { "type": { "type": "string", "example": "Data" }, "id": { "type": "string", "format": "uuid", "example": "00000000-0000-0000-0000-000000000000", "description": "Global unique identifier for any element" }, "data": { "type": "object", "additionalProperties": true, "example": { "created": "2025-09-27T10:39:51+00:00", "updated": "2025-09-27T10:39:51+00:00", "name": "some name" } }, "file": { "type": "object", "additionalProperties": true, "readOnly": true, "example": { "contentLength": 63933, "extension": "jpg", "mimeType": "image/jpeg" } }, "start": { "type": "string", "format": "uuid", "example": "00000000-0000-0000-0000-000000000000", "description": "Global unique identifier for any element" }, "end": { "type": "string", "format": "uuid", "example": "00000000-0000-0000-0000-000000000000", "description": "Global unique identifier for any element" } } } ``` [MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Status/200) · [HTTP.dev](https://http.dev/200) ### 304 · Not Modified Not modified. Returned when `If-None-Match` header matches current `ETag`. #### Headers ```http Access-Control-Allow-Headers: Authorization, Origin, X-Requested-With, Content-Type, Accept, Access-Control-Request-Method Access-Control-Allow-Methods: GET, HEAD, POST, OPTIONS, PUT, PATCH, DELETE, PROPFIND, PROPPATCH, MKCOL, COPY, MOVE, LOCK, UNLOCK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: ETag, Location Allow: GET, HEAD, POST, OPTIONS, PUT, PATCH, DELETE, PROPFIND, PROPPATCH, MKCOL, COPY, MOVE, LOCK, UNLOCK Cache-Control: no-cache, private ETag: "YgbFC4u5EgC" X-Powered-By: Ember Nexus API ``` [MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Status/304) · [HTTP.dev](https://http.dev/304) ### 401 · Unauthorized The provided token is either invalid or expired. #### Body ```json { "type": "https://api.example.com/error/401/unauthorized", "title": "Unauthorized", "status": 401, "detail": "Authorization for the request failed due to possible problems with the token (incorrect or expired), password (incorrect or changed), the user's unique identifier, or the user's status (e.g., missing, blocked, or deleted)." } ``` #### Headers `Access-Control-Allow-Headers`, `Access-Control-Allow-Methods`, `Access-Control-Allow-Origin`, `Access-Control-Expose-Headers`, `Allow`, `Cache-Control`, `X-Powered-By`. Descriptions and example values are in the Response Header section below. #### Schema Same as `Problem` — see the Response Schema section below. [MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Status/401) · [HTTP.dev](https://http.dev/401) ### 412 · Precondition Failed Precondition failed. `If-Match` or `If-None-Match` condition not met. #### Body ```json { "type": "https://api.example.com/error/412/precondition-failed", "title": "Precondition Failed", "status": 412, "detail": "Precondition does not match." } ``` #### Headers `Access-Control-Allow-Headers`, `Access-Control-Allow-Methods`, `Access-Control-Allow-Origin`, `Access-Control-Expose-Headers`, `Allow`, `Cache-Control`, `X-Powered-By`. Descriptions and example values are in the Response Header section below. #### Schema Same as `Problem` — see the Response Schema section below. [MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Status/412) · [HTTP.dev](https://http.dev/412) ## Request Header ### `Authorization` (optional) Bearer token for user authentication. If omitted, the request is processed as an anonymous user; if provided, the associated user account is used. [MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Authorization) · [HTTP.dev](https://http.dev/authorization) · [Authentication guide](/guide/authentication.md) ### `If-Match` (optional) Used primarily for optimistic concurrency control — the request is only executed if the resource's `ETag` matches the provided value. [MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/If-Match) · [HTTP.dev](https://http.dev/if-match) · [Caching guide](/guide/caching-and-conditional-requests.md) ### `If-None-Match` (optional) Used primarily for caching — skips re-downloading an unchanged resource by returning `304 Not Modified` if the resource's `ETag` matches the provided value. [MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/If-None-Match) · [HTTP.dev](https://http.dev/if-none-match) · [Caching guide](/guide/caching-and-conditional-requests.md) ## Response Schema ### `Problem` RFC 7807 Problem Details object. ```json { "$schema": "https://spec.openapis.org/oas/3.0/schema/2021-09-28#/definitions/Schema", "type": "object", "description": "RFC 7807 Problem Details object.", "properties": { "type": { "type": "string", "format": "uri" }, "title": { "type": "string" }, "status": { "type": "integer" }, "detail": { "type": "string" } } } ``` ## Response Header ### `ETag` (always) Entity tag used for caching and optimistic concurrency control. Example: `"YgbFC4u5EgC"` [MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/ETag) · [HTTP.dev](https://http.dev/etag) · [Caching guide](/guide/caching-and-conditional-requests.md) ### Other Headers #### `Access-Control-Allow-Headers` (always) Specifies which HTTP headers can be used during a cross-origin request, returned in preflight responses. Example: `Authorization, Origin, X-Requested-With, Content-Type, Accept, Access-Control-Request-Method` [MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Access-Control-Allow-Headers) · [HTTP.dev](https://http.dev/access-control-allow-headers) #### `Access-Control-Allow-Methods` (always) Indicates which HTTP methods are permitted for cross-origin requests, typically returned in preflight responses. Example: `GET, HEAD, POST, OPTIONS, PUT, PATCH, DELETE, PROPFIND, PROPPATCH, MKCOL, COPY, MOVE, LOCK, UNLOCK` [MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Access-Control-Allow-Methods) · [HTTP.dev](https://http.dev/access-control-allow-methods) #### `Access-Control-Allow-Origin` (always) Specifies which origin(s) may access the resource. Example: `*` [MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Access-Control-Allow-Origin) · [HTTP.dev](https://http.dev/access-control-allow-origin) #### `Access-Control-Expose-Headers` (always) Lists the response headers that browsers are allowed to access from JavaScript beyond the default restricted set. Example: `ETag, Location` [MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Access-Control-Expose-Headers) · [HTTP.dev](https://http.dev/access-control-expose-headers) #### `Allow` (always) Lists the HTTP methods supported by the endpoint; returned alongside a `405 Method Not Allowed` response. Example: `GET, HEAD, POST, OPTIONS, PUT, PATCH, DELETE, PROPFIND, PROPPATCH, MKCOL, COPY, MOVE, LOCK, UNLOCK` [MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Allow) · [HTTP.dev](https://http.dev/allow) #### `Cache-Control` (always) Directives controlling caching behavior for the response. Example: `no-cache, private` [MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cache-Control) · [HTTP.dev](https://http.dev/cache-control) #### `X-Powered-By` (always) Identifies the underlying API implementation. Example: `Ember Nexus API` [MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Powered-By) · [HTTP.dev](https://http.dev/x-powered-by) --- Home: [Ember Nexus API docs](/index.md) Full site map: [llms.txt](/llms.txt) Previous: [Post token](/api/post-token.md) Next: [Delete token](/api/delete-token.md)