> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/sast-and-sca/prezero/api/tokens.md).
# Working with the Qwiet API's tokens endpoints
This article walks you through using the token-related endpoints available via the Qwiet API.
We [offer a Postman Collection](https://www.postman.com/qwietai/workspace/qwiet-docs/collection/9829310-0a2fce9d-f679-41e8-a438-bcf13ddec403?ctx=documentation) that includes these endpoints; the relevant section of the Collection is called **Tokens**. We suggest [creating an environment](https://learning.postman.com/docs/sending-requests/managing-environments/#creating-environments) to store frequently used variables (including your Qwiet access token and org ID values).
## Before proceeding, you should have…
Your access token and org ID values (both are available in the [Qwiet Dashboard](https://app.shiftleft.io/user/profile)).
## Authentication
The Qwiet API uses bearer authentication, which means that you must pass in a bearer token before you make calls to any of the endpoints. More specifically, you must provide your Qwiet access token in the HTTP Authorization request header before proceeding.
## Get organization roles
*Return a list of roles an org has available to use (includes only the roles that Qwiet manages).*
```
curl GET \
'https://app.shiftleft.io/api/v4/orgs/{orgId}/roles' \
--header 'Authorization: Bearer {accessToken}'
```
 
Sample response:
```
{
"ok": true,
"response": [
{
"id": "66…35",
"role_type": "managed",
"label": "CI Token",
"description": "Grants permissions required to invoke the Qwiet CLI"
}
]
}
```
 
## Get tokens
*Return a list of tokens issued by the org. The token data returned includes metadata that identifies a token, included permissions, and an ID you can use to delete/revoke the token. The token data does NOT return the token value, which is exposed only when Qwiet issues the token.*
```
curl GET \
'https://app.shiftleft.io/api/v4/orgs/{orgId}/tokens?show_expired={true|false} \
--header 'Authorization: Bearer {accessToken}'
```
 
Sample response:
```
{
"ok": true,
"response": [
{
"id": "76…eab",
"label": "Jira",
"description": "For Jira integration",
"role_id": "5b…39b"
}
]
}
```
 
## Create token
*Create a new token for use with the API. The token can be assigned a role using the `role_id` parameter in the request body. Obtain the `role_id` using the GET organization role endpoint.*
```
curl POST \
https://app.shiftleft.io/api/v4/orgs/{orgID}/tokens' \
--header 'Authorization: Bearer {accessToken}' \
--header 'Content-Type: application/json' \
--data-raw '{
"label": "tokenName",
"description": "A description of the token",
"role_id": "The role ID to assign",
"token_type": "access or integration",
"valid_for_seconds": 600
}'
```
 
Sample response:
```
{
"ok": true,
"response": {
"id": "e83…abfd",
"label": "tokenName",
"description": "A description of the token",
"value": "eyJ...BVw"
}
}
```
 
## Delete token
*Delete an access token using its identifier.*
```
curl -g DELETE \
'https://app.shiftleft.io/api/v4/orgs/{orgID}/tokens/{tokenID}' \
--header 'Authorization: Bearer {accessToken}'
```
 
Sample response:
```
{
"ok": true
}
```
 