### Proposal Create an _admin_ API endpoint, which returns information about an arbitrary token you provide. We have many [different tokens](https://docs.gitlab.com/ee/security/token_overview.html) for different purposes. It would be fantastic to be able to pass a given token into an info endpoint to receive information about it. Simply observing the token prefix would advise what _type_ of token it could be, but having this endpoint would then go into detail about _where_, _what_, _when_ and _who_ about the token. This would quickly track down not only an owner of said token but it's impact if a token were to be leaked. #### PoC Where `$adminToken` is an admin level Personal Access Token & `$anyTokenHere` is _any_ GitLab created token listed in the above doc link. i.e: - Job token - Project/Group/Personal access token - Runner auth token - Pipeline Trigger token - etc Request example: ```sh curl -s -H "PRIVATE-TOKEN: $adminToken" "https://gitlab.com/api/v4/admin/tokens/self?token=$anyTokenHere" | jq ``` Response example: (There's likely more fields to add here, if not applicable would be `null` type) ```json { "id": 0123456, "name": "anyTokenHere", "type": "personal_access_token", # The type of token (job, deploy, pipeline trigger, PAT, GAT etc) "created_by": "gitLabUserName", # The username str creator of token (was it made by a user?) "project_id": 123456, # The projectId associated with this token (is this a project-level token? A deploy token?) "group_id": 123456, # The groupId associated with this token (is this a group-level token?) "job_id": 123456, # The jobId (if this is a job-token?) "runner_id": 123456, # The runnerId (is this a runner auth token?) "revoked": false, "created_at": "2023-10-09T22:15:41.919Z", "scopes": [ "api", "read_api" ], "user_id": 6543210, "last_used_at": "2024-02-27T23:28:27.908Z", "active": true, "expires_at": "2024-10-08" } ``` ### Active similar examples You can get information around a personal access token by hitting: `/api/v4/user` or `/api/v4/personal_access_token/self` **However** the token _must_ have `api` or `read_api` scopes set. Otherwise a 403 will be returned. So this feature request would allow those tokens to still be passed to the admin endpoint to reveal information about them. ### Implementation Status | Token Type | Status | Issue | MR | |------------|--------|-------|----| | Personal access token | :white_check_mark: | https://gitlab.com/gitlab-org/gitlab/-/issues/443597 | https://gitlab.com/gitlab-org/gitlab/-/merge_requests/165157 | | OAuth Application Secret | :white_check_mark: | https://gitlab.com/gitlab-org/gitlab/-/issues/443597 | https://gitlab.com/gitlab-org/gitlab/-/merge_requests/172985 | | Impersonation token | :white_check_mark: | https://gitlab.com/gitlab-org/gitlab/-/issues/506501 | https://gitlab.com/gitlab-org/gitlab/-/merge_requests/173975 | | Project access token | :white_check_mark: | https://gitlab.com/gitlab-org/gitlab/-/issues/443597 | https://gitlab.com/gitlab-org/gitlab/-/merge_requests/165157 | | Group access token | :white_check_mark: | https://gitlab.com/gitlab-org/gitlab/-/issues/443597 | https://gitlab.com/gitlab-org/gitlab/-/merge_requests/165157 | | Deploy token | :white_check_mark: | https://gitlab.com/gitlab-org/gitlab/-/issues/443597 | https://gitlab.com/gitlab-org/gitlab/-/merge_requests/165157 | | Runner authentication token | :white_check_mark: | https://gitlab.com/gitlab-org/gitlab/-/issues/506513 | https://gitlab.com/gitlab-org/gitlab/-/merge_requests/173987 | | CI/CD Job token | :white_check_mark: | https://gitlab.com/gitlab-org/gitlab/-/issues/508619 | https://gitlab.com/gitlab-org/gitlab/-/merge_requests/175234 | | Trigger token | :white_check_mark: | https://gitlab.com/gitlab-org/gitlab/-/issues/506554 | https://gitlab.com/gitlab-org/gitlab/-/merge_requests/174030 | | Feed token | :white_check_mark: | https://gitlab.com/gitlab-org/gitlab/-/issues/443597 | https://gitlab.com/gitlab-org/gitlab/-/merge_requests/170690 | | Incoming mail token | :white_check_mark: | https://gitlab.com/gitlab-org/gitlab/-/issues/512033 | https://gitlab.com/gitlab-org/gitlab/-/merge_requests/177077 | | GitLab agent for Kubernetes token | :white_check_mark: | https://gitlab.com/gitlab-org/gitlab/-/issues/443597 | https://gitlab.com/gitlab-org/gitlab/-/merge_requests/172932 | | GitLab session cookies | :white_check_mark: | https://gitlab.com/gitlab-org/gitlab/-/issues/512654 | https://gitlab.com/gitlab-org/gitlab/-/merge_requests/178022 | | SCIM Tokens | :white_check_mark: | https://gitlab.com/gitlab-org/gitlab/-/issues/512768 | https://gitlab.com/gitlab-org/gitlab/-/merge_requests/231880 | | Feature Flags Client token | :white_check_mark: | https://gitlab.com/gitlab-org/gitlab/-/issues/512283 | https://gitlab.com/gitlab-org/gitlab/-/merge_requests/177431 |