Appearance
Personal Access Tokens Beta
A PAT (personal access token) is a credential for operating Codatum from the Codatum CLI. For how each user issues and edits their own tokens, see the account's Personal Access Tokens page.
From global nav > Workspace settings > Personal Access Tokens, you can list and manage PATs issued within the workspace.
INFO
This feature is in beta. The specification might change without notice.
Prerequisites
- The menu is shown and usable only if the workspace policy doesn't disable Codatum CLI use.
- Guests can't use PATs.
- Suspend / Resume / Revoke can be performed by a Workspace Owner (Workspace permissions).
List
| Column | Description |
|---|---|
| Issuer | The user who issued the token |
| Name (token) | The token name and a masked display with a prefix |
| Permission restriction | Configured if a permission boundary is set; otherwise - |
| Last used | The last-used time (Unused if never used) |
| Expires | The token's expiration date |
| Status | Active / Suspended / Revoked / Expired |
By default, revoked and expired tokens are hidden. Turn on Show revoked and expired to include them in the list. You can search by token name or issuer.
Operations
| Operation | Description |
|---|---|
| View permissions | Check the grants of a token that has a permission restriction configured |
| Suspend | Temporarily blocks authentication for an active token, until resumed |
| Resume | Re-enables authentication for a suspended token |
| Revoke | Immediately invalidates the token. This can't be undone |
You can check the audit log for PAT changes from Change log. For an overview of the audit log, see Audit log.
Relationship with account settings
| Location | What you can do |
|---|---|
| Personal Access Tokens in account settings | Create, update, suspend, and revoke tokens you issue yourself |
| Personal Access Tokens in workspace settings (this page) | List tokens issued within the workspace, and Suspend / Resume / Revoke / View permissions |
A permission boundary is a mechanism that caps the token at the issuing account's user permissions, then further narrows it to a scope of connections / notebooks / tags. For an overview, see Permissions overview.