Personal Access Tokens

Personal access tokens (PATs) are long-lived credentials scoped to specific permissions. Use them for scripted workflows, CI integrations, or anywhere you cannot use an interactive login.

Creating a token

POST /api/v1/user/tokens
Authorization: Bearer <jwt>

{
  "name": "my-ci-token",
  "scopes": ["repo:read", "ci:write"],
  "expires_at": "2027-01-01T00:00:00Z"  // optional
}

Response (201 Created):

{
  "token": "vetrix_abc123...",
  "name": "my-ci-token",
  "scopes": ["repo:read", "ci:write"]
}

The raw token is returned once only. Store it securely — it cannot be retrieved again.

Using a token

Supply the PAT as a Bearer token in the Authorization header:

Authorization: Bearer vetrix_abc123...

Listing tokens

GET /api/v1/user/tokens

Returns all tokens for the authenticated user. The raw token value is never returned — only the name, scopes, expiry, and last-used timestamp.

Revoking a token

DELETE /api/v1/user/tokens/{id}

Available scopes

Scope	Description
repo:read	Clone and browse repositories
repo:write	Push code, manage issues, merge merge requests
repo:admin	Manage repository settings, protection rules, webhooks
issue:read	Read issues and comments
issue:write	Create and update issues and comments
ci:read	View pipelines and job logs
ci:write	Trigger and cancel pipelines
registry:read	Pull container images and download packages
registry:write	Push images and publish packages
admin:users	Manage users (admin only)
admin:system	Manage instance settings (admin only)

Expiry

Tokens with an expires_at value are automatically rejected after that time. Tokens without an expiry are valid until revoked.