> ## Documentation Index > Fetch the complete documentation index at: https://docs.auditynow.com/llms.txt > Use this file to discover all available pages before exploring further. # List the user's Personal Access Tokens (browser session only) > Returns the metadata for active (non-revoked) PATs belonging to the authenticated user. Plaintext tokens are NEVER returned, only `tokenPrefix` (first 6 chars) for visual identification. **Browser session required.** This endpoint cannot be called with a PAT, doing so returns 403 `PAT_NOT_SUPPORTED_FOR_ENDPOINT`. This is deliberate: PATs cannot create or list other PATs (no recursion). Surfaced here so SDK builders know the management surface exists. Response wrapper: `{ keys: PatPublic[] }`. ## OpenAPI ````yaml /api-reference/openapi.json get /api/user/api-keys openapi: 3.1.0 info: title: Audity Agent API version: 1.0.0 summary: >- The agent-facing surface of Audity AI: projects, leads, Nucleus, and account. description: >- Audity is a B2B SaaS for consultants who run automated business audits. This API is the agent-facing slice: a deliberately small set of task-shaped endpoints that lets external AI agents (Claude, ChatGPT, Cursor, n8n) act on a consultant's Audity workspace on their behalf. **Authentication:** Bearer token (`aky_...`) issued from `https://app.auditynow.com/dashboard/settings/api-tokens`. The middleware resolves the token to a Clerk user identity; tier and Row-Level Security gates apply automatically. **Rate limits:** reads 100/min, writes 20/min, async job polling 120/min; some expensive or high-volume endpoints have stricter caps. 429 responses include `Retry-After`. **Tier gating:** public plan names can change faster than API enum names. Use `GET /api/user/tier` and any `requiredTier` field in 403 responses as the source of truth for a specific account. Read-only or lead-generation-focused plans can read available data; audit-capable paid plans unlock writes, subject to token scope and credits. contact: name: Audity Support email: support@auditynow.com url: https://app.auditynow.com license: name: Proprietary identifier: LicenseRef-Audity-Proprietary termsOfService: https://auditynow.com/terms servers: - url: https://app.auditynow.com description: Production security: - bearerAuth: [] tags: - name: Projects description: >- Audit project lifecycle, create, list, fetch, trigger analysis, get deliverables. - name: Leads description: ReadyLink-sourced leads, list, fetch, convert into projects. - name: Nucleus description: >- Nucleus is Audity's persistent memory + insight layer. Search memories, capture notes, read proactive insights, manage contacts. - name: Account description: Identity, tier, credits, usually called once per session for context. - name: ReadyLinks description: >- Manage ReadyLinks, the survey distribution links that generate leads. CRUD operations for links, customization, lead tracking. - name: Assessment Configs description: >- Manage assessment configurations that define survey questions, order, scoring, and customization. - name: Jobs description: >- Monitor async job status for long-running operations like audit analysis synthesis. paths: /api/user/api-keys: get: tags: - Account summary: List the user's Personal Access Tokens (browser session only) description: >- Returns the metadata for active (non-revoked) PATs belonging to the authenticated user. Plaintext tokens are NEVER returned, only `tokenPrefix` (first 6 chars) for visual identification. **Browser session required.** This endpoint cannot be called with a PAT, doing so returns 403 `PAT_NOT_SUPPORTED_FOR_ENDPOINT`. This is deliberate: PATs cannot create or list other PATs (no recursion). Surfaced here so SDK builders know the management surface exists. Response wrapper: `{ keys: PatPublic[] }`. operationId: listApiKeys responses: '200': description: List of active PATs content: application/json: schema: type: object properties: keys: type: array items: $ref: '#/components/schemas/PatPublic' required: - keys '401': $ref: '#/components/responses/Unauthorized' '403': description: Called with a PAT instead of a browser session. content: application/json: schema: $ref: '#/components/schemas/ErrorWithCode' example: error: API token management requires a browser session, not a PAT code: PAT_NOT_SUPPORTED_FOR_ENDPOINT components: schemas: PatPublic: type: object description: >- Safe-to-display metadata for a Personal Access Token. The plaintext token is NEVER returned here, only on creation. properties: id: type: string format: uuid label: type: string description: User-supplied label for the token. tokenPrefix: type: string description: >- First 6 chars of the token (e.g. `aky_a1b`), for visual identification. scopes: type: array items: type: string enum: - read - write expiresAt: type: - string - 'null' format: date-time lastUsedAt: type: - string - 'null' format: date-time createdAt: type: string format: date-time required: - id - label - tokenPrefix - scopes - createdAt ErrorWithCode: type: object description: >- Error response with an optional stable `code` field. When present, branch on `code` (the human-readable `error` may change). Some 403/400 responses omit `code` (e.g. generic feature-disabled gates). properties: error: type: string description: Human-readable error message. code: type: string description: >- Stable error code, when applicable. Examples: `EMPTY_PATCH`, `INVALID_DESCRIPTION_TYPE`, `DESCRIPTION_TOO_LONG`, `PAT_MALFORMED`, `PAT_ROUTE_NOT_ALLOWED`, `PAT_NOT_SUPPORTED_FOR_ENDPOINT`, `PAT_SCOPE_INSUFFICIENT`, `PAT_DISABLED`. required: - error Error: type: object properties: error: type: string description: Human-readable error message. details: type: string description: Additional context (development only). required: - error responses: Unauthorized: description: Missing or invalid token. content: application/json: schema: $ref: '#/components/schemas/Error' example: error: Unauthorized securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: Audity Personal Access Token (aky_...) description: >- A Personal Access Token issued from https://app.auditynow.com/dashboard/settings/api-tokens. Format: `aky_<32 random chars>`. ````