Long lived access tokens (type: API) that let a script call the API with the rights of a single user. The usual way to obtain one is the user panel of the web interface; the endpoints below do the same thing programmatically. A token is used by sending it in the Authorization: Bearer <token> header of every request - see the QuickStart guide. The endpoints are served from /new_api/users/{userId}/auth_tokens.

A user can manage their own tokens, and administrators can create and cancel tokens of any user. Listing is the exception: because it returns the secret values, only the owner of the tokens can list them, not even an administrator. The expiration date cannot be later than one year from now.

1. Add an auth token for a user

Issues a new API token for the given user; the response contains the secret token value to put in the Authorization header. The name is only a label to recognise the token later, and an expirationDate more than one year ahead is rejected. The call fails with a conflict if the instance is not configured to issue API tokens.

1.1. HTTP request

POST /minerva/new_api/users/1/auth_tokens/ HTTP/1.1

1.2. Path Parameters

Table 1. /minerva/new_api/users/{userId}/auth_tokens/
Parameter Description

userId

user id

1.3. Request Fields

Path Type Description

name

String

token name

expirationDate

String

token expiration date (max 1 year)

1.4. CURL sample

$ curl 'https://minerva-dev.lcsb.uni.lu/minerva/new_api/users/1/auth_tokens/' -X POST \
    -H 'Authorization: Bearer xxxxxxxx' \
    -d '{"expirationDate":"2026-09-24T00:13:25Z","name":"Lupe Mosciski"}' \
    -H 'Content-Type: application/json'

1.5. HTTP response

HTTP/1.1 201 Created

1.6. Response Fields

Path Type Description

id

Number

identifier

active

Boolean

is the token active

expirationDate

String

moment after which the token is no longer accepted

createdAt

String

when token was created

name

String

token name

type

String

token type (API for user-generated tokens)

userId

Number

user identifier

token

String

secret auth token

1.7. Sample Response

{
  "id" : 554,
  "token" : "eyJhbGciOiJIUzUxMiJ9.eyJzdWIiOiJhZG1pbiIsImZpcnN0TmFtZSI6IiIsImxhc3ROYW1lIjoiIiwiaWF0IjoxNzkwMjA1MjA1LCJleHAiOjE3OTAyMDg4MDV9.YVeWe2Qzp9OSP70ky7VLkSWA2ixJcbThkvLbYV2QUeVW3PpMOSXeCPwALz-HVahv-wasBQzdxAH8e_IlSyKHLA",
  "name" : "Lupe Mosciski",
  "active" : true,
  "type" : "API",
  "expirationDate" : "2026-09-24T00:13:25Z",
  "createdAt" : "2026-09-23T23:13:25Z",
  "userId" : 1
}

2. List user auth tokens

Returns the user’s API tokens with their name, creation and expiration dates, the secret value and whether they are still active; short lived tokens issued during login are not listed. Since the secret values are included, only the owner may call this - an administrator asking for somebody else’s tokens is rejected. The list is not paginated, and cancelled tokens remain in it marked as inactive.

2.1. HTTP request

GET /minerva/new_api/users/1/auth_tokens/ HTTP/1.1

2.2. Path Parameters

Table 2. /minerva/new_api/users/{userId}/auth_tokens/
Parameter Description

userId

user id

2.3. CURL sample

$ curl 'https://minerva-dev.lcsb.uni.lu/minerva/new_api/users/1/auth_tokens/' -X GET \
    -H 'Authorization: Bearer xxxxxxxx'

2.4. HTTP response

HTTP/1.1 200 OK

2.5. Response Fields

Path Type Description

[].id

Number

identifier

[].active

Boolean

is the token active

[].expirationDate

String

moment after which the token is no longer accepted

[].createdAt

String

when token was created

[].name

String

token name

[].type

String

token type (API for user-generated tokens)

[].userId

Number

user identifier

[].token

String

secret auth token

2.6. Sample Response

[ {
  "id" : 555,
  "token" : "eyJhbGciOiJIUzUxMiJ9.eyJzdWIiOiJhZG1pbiIsImZpcnN0TmFtZSI6IiIsImxhc3ROYW1lIjoiIiwiaWF0IjoxNzkwMjA1MjA1LCJleHAiOjE3OTAyMDkwNjB9.XLSCSJiLwDUdtGTiM2Lpif4jlo-VItn2hxJT7sfYVCKUTgbimNnsGOYzCxeY7hb1W7sLyY6wo8kx21uiYmGXCg",
  "name" : "documentation",
  "active" : true,
  "type" : "API",
  "expirationDate" : "2026-09-24T00:17:40Z",
  "createdAt" : "2026-09-23T23:13:25Z",
  "userId" : 1
}, {
  "id" : 556,
  "token" : "xnoyswmibhqhewstdfcyfzfkjtylxkkcxjcsbgybotxyajbbdyassoxlrfzjwoak",
  "name" : "Irwin Bernhard",
  "active" : true,
  "type" : "API",
  "expirationDate" : "2026-09-24T23:13:25Z",
  "createdAt" : "2026-09-23T23:13:25Z",
  "userId" : 1
}, {
  "id" : 557,
  "token" : "aonyaoaxodaiegsitmesbzwerajmmwznquxiygeubodetnxismbqaldwspaawwyt",
  "name" : "Stacie Halvorson",
  "active" : true,
  "type" : "API",
  "expirationDate" : "2026-09-24T23:13:25Z",
  "createdAt" : "2026-09-23T23:13:25Z",
  "userId" : 1
} ]

3. Cancel user auth token

Invalidates a token immediately, so any script still using it stops being authenticated. A token that has not expired yet is kept as a record with active set to false; an already expired or inactive one is deleted outright. The token must belong to the user in the path, otherwise the request is answered as if it did not exist.

3.1. HTTP request

DELETE /minerva/new_api/users/1/auth_tokens/558 HTTP/1.1

3.2. Path Parameters

Table 3. /minerva/new_api/users/{userId}/auth_tokens/{tokenId}
Parameter Description

userId

user id

tokenId

token identifier

3.3. CURL sample

$ curl 'https://minerva-dev.lcsb.uni.lu/minerva/new_api/users/1/auth_tokens/558' -X DELETE \
    -H 'Authorization: Bearer xxxxxxxx'

3.4. HTTP response

HTTP/1.1 200 OK

3.5. Response Fields

Path Type Description

id

Number

identifier

active

Boolean

is the token active

expirationDate

String

moment after which the token is no longer accepted

createdAt

String

when token was created

name

String

token name

type

String

token type (API for user-generated tokens)

userId

Number

user identifier

token

String

secret auth token

3.6. Sample Response

{
  "id" : 558,
  "token" : "eyJhbGciOiJIUzUxMiJ9.eyJzdWIiOiJhZG1pbiIsImZpcnN0TmFtZSI6IiIsImxhc3ROYW1lIjoiIiwiaWF0IjoxNzkwMjA1MjA1LCJleHAiOjE3OTAyMDg4MDV9.YVeWe2Qzp9OSP70ky7VLkSWA2ixJcbThkvLbYV2QUeVW3PpMOSXeCPwALz-HVahv-wasBQzdxAH8e_IlSyKHLA",
  "name" : "Taylor Dare",
  "active" : false,
  "type" : "API",
  "expirationDate" : "2026-09-24T00:13:25Z",
  "createdAt" : "2026-09-23T23:13:25Z",
  "userId" : 1
}