> This page is for API, version 2026-01-01 (Stable) (default). > For other versions, use one of these documentation indexes: > - 2026-01-01 (Stable) (default): https://docs.deel.wtf/api/stable/llms.txt > For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.deel.wtf/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.deel.wtf/_mcp/server. # Retrieve an API token GET https://api.letsdeel.com/rest/api-tokens/{token_id} Retrieves an API token, without its secret value. Use it to inspect a token whose id you already know, for example one flagged as stale, expiring or orphaned in the list of API tokens. **Token scopes**: `tokens:read` **Beta**: this version requires the `X-Beta: true` request header and its contract may change before it is promoted to stable. It is scheduled to become stable on 2027-02-03. Reference: https://docs.deel.wtf/api/reference/endpoints/api-tokens/get-api-token-v-2026-11-03 ## Authentication - `Authorization` header (bearer token, required) — ## Authentication The Deel API uses bearer tokens to authenticate requests. All API calls must be made over HTTPS — calls over plain HTTP or without authentication will fail. ```curl curl -X GET 'https://api.deel.training/rest/v2/contracts' \ -H 'Authorization: Bearer YOUR-TOKEN-HERE' ``` [Learn more about authentication](/api/authentication) - `Authorization` header (bearer token, required) — Standard OAuth2 security scheme based on https://swagger.io/docs/specification/authentication/ ## Servers - `https://api.letsdeel.com/rest` (Production, default) - `https://api-staging.letsdeel.com/rest` (Demo) ## Request ### Path parameters - `token_id` (string, required) — Unique identifier of the API token. ### Headers - `X-Beta` (enum, required, default: true) — Opts in to the beta version of this endpoint. Must be `true`. - Allowed values: `true` ## Response ### 200 The API token. - `data` (ApiTokensTokenIdGetResponsesContentApplicationJsonSchemaData, required) ## Errors ### 400 Bad Request Error Bad Request. A parameter is missing or invalid. - `errors` (list of ApiTokensTokenIdGetResponsesContentApplicationJsonSchemaErrorsItems, required) — The list of errors that caused the request to fail. ### 401 Unauthorized Error Unauthorized. Authentication credentials were missing or invalid. - `errors` (list of ApiTokensTokenIdGetResponsesContentApplicationJsonSchemaErrorsItems, required) — The list of errors that caused the request to fail. ### 403 Forbidden Error Forbidden. The caller cannot manage the Developer Center, or the token lacks the required scope. - `errors` (list of ApiTokensTokenIdGetResponsesContentApplicationJsonSchemaErrorsItems, required) — The list of errors that caused the request to fail. ### 404 Not Found Error Not Found. No token with this id exists, or it belongs to someone else. - `errors` (list of ApiTokensTokenIdGetResponsesContentApplicationJsonSchemaErrorsItems, required) — The list of errors that caused the request to fail. ### 429 Too Many Requests Error Too Many Requests. The rate limit has been exceeded. - `errors` (list of ApiTokensTokenIdGetResponsesContentApplicationJsonSchemaErrorsItems, required) — The list of errors that caused the request to fail. ### 500 Internal Server Error Internal Server Error. An unexpected error occurred. - `errors` (list of ApiTokensTokenIdGetResponsesContentApplicationJsonSchemaErrorsItems, required) — The list of errors that caused the request to fail. ## Types ### ApiTokensTokenIdGetResponsesContentApplicationJsonSchemaData - `id` (string, required) — Unique identifier of the API token. - `label` (string, required) — Name given to the token when it was created. - `scopes` (list of string, required) — Scopes the token was granted. - `status` (enum, required) — Where the token is in its lifecycle. `EXPIRING` means it expires within 14 days. - Allowed values: `ACTIVE`, `EXPIRING`, `EXPIRED`, `INVALIDATED` - `is_stale` (boolean, required) — True when the token is usable but has not been used for 60 days. - `group_ids` (list of integer, required) — Groups the token is limited to; empty when it is not limited. - `created_at` (string, required, nullable) — When the token was created. - `created_by` (ApiTokensTokenIdGetResponsesContentApplicationJsonSchemaDataCreatedBy, required, nullable) — Who created, or now owns, the token. Null for tokens created before owners were recorded. - `expires_at` (string, required, nullable) — When the token expires; null when it never expires. - `token_type` (enum, required) — `PERSONAL` tokens act as the person who created them; `ORGANIZATION` tokens act for the whole organization. - Allowed values: `PERSONAL`, `ORGANIZATION` - `integration` (string, required, nullable) — Integration the token was created for, if any. - `last_used_at` (string, required, nullable) — When the token last called the API. - `invalidated_at` (string, required, nullable) — When the token was invalidated. - `invalidated_by` (ApiTokensTokenIdGetResponsesContentApplicationJsonSchemaDataInvalidatedBy, required, nullable) — Who invalidated the token. Null unless it was invalidated. - `invalidation_reason` (string, required, nullable) — Reason given when the token was invalidated. - `should_hide_pii_data` (boolean, required) — True when responses to this token omit personal data. - `should_hide_employment_data` (boolean, required) — True when responses to this token omit employment data. ### ApiTokensTokenIdGetResponsesContentApplicationJsonSchemaErrorsItems - `code` (string, required) — Machine-readable error code. - `message` (string, required) — Human-readable description of the error. ### ApiTokensTokenIdGetResponsesContentApplicationJsonSchemaDataCreatedBy Who created, or now owns, the token. Null for tokens created before owners were recorded. - `name` (string, required, nullable) — Full name of the person, when known. - `email` (string, required, nullable) — Email of the person, when known. - `status` (enum, required) — `LEFT` when the person no longer belongs to the organization. - Allowed values: `ACTIVE`, `LEFT` - `profile_id` (string, required) — Profile id of the person. ### ApiTokensTokenIdGetResponsesContentApplicationJsonSchemaDataInvalidatedBy Who invalidated the token. Null unless it was invalidated. - `name` (string, required, nullable) — Full name of the person, when known. - `email` (string, required, nullable) — Email of the person, when known. - `status` (enum, required) — `LEFT` when the person no longer belongs to the organization. - Allowed values: `ACTIVE`, `LEFT` - `profile_id` (string, required) — Profile id of the person. ## Examples **Response** ```json { "data": { "id": "7f0c1b9e-3c3a-4a63-9a43-2d6c1a0e8b51", "label": "Payroll sync", "scopes": [ "contracts:read", "people:read" ], "status": "ACTIVE", "is_stale": false, "group_ids": [], "created_at": "2026-09-01T10:00:00.000Z", "created_by": { "name": "Jane Doe", "email": "jane.doe@example.com", "status": "ACTIVE", "profile_id": "1234567" }, "expires_at": "2027-01-01T00:00:00.000Z", "token_type": "ORGANIZATION", "integration": "zapier", "last_used_at": "2026-10-20T08:15:00.000Z", "invalidated_at": "2026-10-21T09:30:00.000Z", "invalidated_by": { "name": "Jane Doe", "email": "jane.doe@example.com", "status": "ACTIVE", "profile_id": "1234567" }, "invalidation_reason": "Rotated after the vendor migration", "should_hide_pii_data": false, "should_hide_employment_data": false } } ``` **SDK Code** ```python import requests url = "https://api.letsdeel.com/rest/api-tokens/7f0c1b9e-3c3a-4a63-9a43-2d6c1a0e8b51" headers = { "X-Beta": "true", "Authorization": "Bearer " } response = requests.get(url, headers=headers) print(response.json()) ``` ```javascript const url = 'https://api.letsdeel.com/rest/api-tokens/7f0c1b9e-3c3a-4a63-9a43-2d6c1a0e8b51'; const options = {method: 'GET', headers: {'X-Beta': 'true', Authorization: 'Bearer '}}; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ```go package main import ( "fmt" "net/http" "io" ) func main() { url := "https://api.letsdeel.com/rest/api-tokens/7f0c1b9e-3c3a-4a63-9a43-2d6c1a0e8b51" req, _ := http.NewRequest("GET", url, nil) req.Header.Add("X-Beta", "true") req.Header.Add("Authorization", "Bearer ") res, _ := http.DefaultClient.Do(req) defer res.Body.Close() body, _ := io.ReadAll(res.Body) fmt.Println(res) fmt.Println(string(body)) } ``` ```ruby require 'uri' require 'net/http' url = URI("https://api.letsdeel.com/rest/api-tokens/7f0c1b9e-3c3a-4a63-9a43-2d6c1a0e8b51") http = Net::HTTP.new(url.host, url.port) http.use_ssl = true request = Net::HTTP::Get.new(url) request["X-Beta"] = 'true' request["Authorization"] = 'Bearer ' response = http.request(request) puts response.read_body ``` ```java import com.mashape.unirest.http.HttpResponse; import com.mashape.unirest.http.Unirest; HttpResponse response = Unirest.get("https://api.letsdeel.com/rest/api-tokens/7f0c1b9e-3c3a-4a63-9a43-2d6c1a0e8b51") .header("X-Beta", "true") .header("Authorization", "Bearer ") .asString(); ``` ```php request('GET', 'https://api.letsdeel.com/rest/api-tokens/7f0c1b9e-3c3a-4a63-9a43-2d6c1a0e8b51', [ 'headers' => [ 'Authorization' => 'Bearer ', 'X-Beta' => 'true', ], ]); echo $response->getBody(); ``` ```csharp using RestSharp; var client = new RestClient("https://api.letsdeel.com/rest/api-tokens/7f0c1b9e-3c3a-4a63-9a43-2d6c1a0e8b51"); var request = new RestRequest(Method.GET); request.AddHeader("X-Beta", "true"); request.AddHeader("Authorization", "Bearer "); IRestResponse response = client.Execute(request); ``` ```swift import Foundation let headers = [ "X-Beta": "true", "Authorization": "Bearer " ] let request = NSMutableURLRequest(url: NSURL(string: "https://api.letsdeel.com/rest/api-tokens/7f0c1b9e-3c3a-4a63-9a43-2d6c1a0e8b51")! as URL, cachePolicy: .useProtocolCachePolicy, timeoutInterval: 10.0) request.httpMethod = "GET" request.allHTTPHeaderFields = headers let session = URLSession.shared let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in if (error != nil) { print(error as Any) } else { let httpResponse = response as? HTTPURLResponse print(httpResponse) } }) dataTask.resume() ```