# List ingest tokens

> A project's ingest tokens, which OpenTelemetry SDKs and collectors send with: each its name, hint (its first characters), who made it, when, and when it was last used. managed marks the one g1t made for its own deployments, which people cannot delete.

<div class="g1t-endpoint"><span class="g1t-method" data-method="get">GET</span><code>/workspaces/{workspace}/projects/{project}/observability/tokens</code></div>

Secrets are never returned. Needs the Admin role.

Secrets are never returned: `hint` tells tokens apart. The `managed` one is g1t's own, for the project's apps on g1t.page, and is replaced by g1t, not by people. Needs the Admin role.

- **Authentication:** Required. Send an [access token](/reference/api/#authentication) as `Authorization: Bearer`.
- **MCP tool:** None. Signing in is on the REST API only.

## Path parameters

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `workspace` | string | Yes | The workspace's slug, e.g. "flagon-io". |
| `project` | string | Yes | The project's slug, as in g1t.sh/{workspace}/{project}. |

## Example request

```sh
curl https://api.g1t.sh/workspaces/flagon-io/projects/g1t/observability/tokens \
  -H "Authorization: Bearer $G1T_TOKEN"
```

## Example response

A successful request answers `200` with:

```json
[
  {
    "id": "a1b2c3d4",
    "name": "Deployments on g1t.page",
    "hint": "g1to_prj_…2c8e",
    "created_by": null,
    "created_us": 1790841600000000,
    "last_used_us": 1791813809000000,
    "managed": true
  },
  {
    "id": "k3m9q2x7",
    "name": "fly.io collector",
    "hint": "g1to_prj_…9f3a",
    "created_by": "syntaqx",
    "created_us": 1791796364000000,
    "last_used_us": 1791813790000000,
    "managed": false
  }
]
```

## Errors

A failed request answers with one of these statuses and a body like `{"error": {"code": "not_found", "message": "Repository not found."}}`. See [errors](/reference/api/#errors).

| Status | Code | When |
| --- | --- | --- |
| 401 | `unauthenticated` | A token is required, or the one sent is not valid. |
| 403 | `forbidden` | The token is valid but not allowed to do this, such as a member-only change, or a token without the scope it needs. |
| 404 | `not_found` | It does not exist, or you cannot see it. |
| 422 | `invalid` | The input is not valid. `message` says which field and why. |