Access Tokens

API access tokens let your own scripts and integrations call the Telisky API without a browser session. Tokens are scoped and belong to an organization.

Endpoints

Method	Path	Description
GET	/orgs/:orgId/tokens	List the organization’s tokens
POST	/orgs/:orgId/tokens	Create a scoped token
POST	/orgs/:orgId/tokens/:id/rotate	Rotate a token (revoke and reissue)
POST	/orgs/:orgId/tokens/:id/revoke	Revoke a token

Create a token

POST /orgs/:orgId/tokens
Content-Type: application/json

{
  "name": "fleet-sync",
  "scopes": ["device:read", "job:read"]
}

Caution

Creating or rotating a token returns the token value once. Copy it immediately and store it securely - it cannot be retrieved again. If you lose it, rotate the token to get a new value.

Scopes

A token carries only the scopes you grant it. Choose the narrowest set that does the job - a read-only integration should not hold write scopes. Scope values are part of the API contract.

Resource	Scopes
Organization	org:read, org:write, org:create_suborg
Members	member:read, member:invite, member:write
Devices	device:read, device:create, device:write, device:transfer, device:reboot, device:apply_config, device:firmware_update
Config profiles	config:read, config:write
Groups	group:read, group:write
Firmware	firmware:read, firmware:write
Jobs	job:read, job:write
Tokens	token:read, token:write
Audit	audit:read

A token’s effective access is also bounded by the role and permissions of the organization it belongs to.

Rotate and revoke

• Rotate issues a new token value and invalidates the old one - use it on a schedule or if a token may be exposed.
• Revoke disables a token immediately.