how to find attributes of API token

Hi Justin,

Yes, there is a way to retrieve information about API tokens, although it depends on whether you have Organization Admin access.

Atlassian now exposes API token information through the API Access REST API.

For user API tokens in an organization, an Organization Admin can call:

GET https://api.atlassian.com/admin/api-access/v1/orgs/{orgId}/api-tokens

The response includes information such as:

• Token ID
• Label
• Status
• Creation date
• Expiration date
• Last active date
• User/account information
• Scopes

For example, the response contains a structure similar to:

{
  "data": [
    {
      "id": "...",
      "label": "...",
      "status": "ALLOWED",
      "createdAt": "...",
      "expiresAt": "...",
      "lastActiveAt": "...",
      "user": {
        "id": "...",
        "name": "...",
        "email": "..."
      },
      "scopes": [
        "read:jira-work",
        "write:jira-work"
      ]
    }
  ]
}

So if your token was created with scopes, the scopes property lets you identify exactly which scopes were assigned to it.

If it was created using the legacy/general Create API token option without scopes, you should not expect to see a set of granular Jira/Confluence scopes associated with it in the same way.

Important caveat

This API is an organization administration API. It is not a token introspection endpoint where you submit the token value itself.

You need Organization Admin permissions and an appropriate Atlassian Admin API credential with the required read:tokens:admin scope.

So you cannot do something like:

GET /token-info?token=<my-token>

using the expiring token itself and ask Atlassian what permissions that token has.

Instead, you retrieve the organization’s token inventory and identify the token by its label/user/metadata.

You can also check it from the UI

If you are an Organization Admin, Atlassian Administration provides the same type of visibility under:

Atlassian Administration → Insights → API token activity

There you can see token activity for managed accounts, including details such as when a token was created, when it expires, and when it was last used.

For your specific case, I would first check the token in API token activity. If you need the scope information programmatically, use the API Access REST API above.

One additional point: scopes cannot be modified after a token has been created. If you discover that the existing token has the wrong scopes — or if you are unsure about how it was originally configured — the safest approach is usually to create a new scoped token with only the permissions the integration actually requires and replace the old one before it expires.