> ## Documentation Index > Fetch the complete documentation index at: https://docs.flowpayroll.ai/llms.txt > Use this file to discover all available pages before exploring further. # Get an API token and its access > One token, with both kinds of access it may hold, exactly as `GET /users/{principalId}` reports them for a person: - `organisationIds` — every organisation it reaches through a direct grant. - `coversWholeCustomer` — whether it also holds account-wide access, which reaches every organisation the account owns, including ones added later, and names none of them. **Read `coversWholeCustomer` before treating an empty `organisationIds` as no access.** There are no roles: a credential either reaches an organisation or it does not, and one that reaches it may do everything in it. To change the direct grants, use `/api-tokens/{clientId}/organisations`; for account-wide access, `/api-tokens/{clientId}/customer-access`. No response from this endpoint contains a secret. ## OpenAPI ````yaml /api-reference/specs/administration.json get /api-tokens/{clientId} openapi: 3.0.1 info: title: Administration API description: >- Manage your Flow Payroll account: the organisations it owns, the people who can sign in to it, the API tokens it holds, its brand, and a feed of recent administration activity. Every resource is scoped to the account your credentials belong to, so no request ever names a customer and the `X-Org-Id` header is not used. version: v1 servers: - url: https://api.sandbox.flowpayroll.ai/v1/administration security: - X-Auth-Token: [] tags: - name: Customer description: >- Your account: the customer every other resource on this API belongs to. Read it and rename it. - name: Organisations description: >- The organisations your account owns: list them with headcounts and your access to each, get one in full, and add one or several at a time. - name: Users description: >- The people who can sign in to your account: list, invite (one or many), resend invitations, and manage each person's direct grants and account-wide access. - name: API tokens description: >- The client credentials your integrations authenticate with: create (the secret is shown once), rename, rotate, revoke, and manage which organisations each token reaches. - name: Activity description: Recent administration actions in your account, newest first. paths: /api-tokens/{clientId}: get: tags: - API tokens summary: Get an API token and its access description: >- One token, with both kinds of access it may hold, exactly as `GET /users/{principalId}` reports them for a person: - `organisationIds` — every organisation it reaches through a direct grant. - `coversWholeCustomer` — whether it also holds account-wide access, which reaches every organisation the account owns, including ones added later, and names none of them. **Read `coversWholeCustomer` before treating an empty `organisationIds` as no access.** There are no roles: a credential either reaches an organisation or it does not, and one that reaches it may do everything in it. To change the direct grants, use `/api-tokens/{clientId}/organisations`; for account-wide access, `/api-tokens/{clientId}/customer-access`. No response from this endpoint contains a secret. operationId: GetApiToken parameters: - name: clientId in: path required: true schema: type: string responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/ApiTokenDetailResponseResponseBody' '401': description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/ObjectResponseBody' '403': description: Forbidden content: application/json: schema: $ref: '#/components/schemas/ObjectResponseBody' '404': description: Not Found content: application/json: schema: $ref: '#/components/schemas/ObjectResponseBody' components: schemas: ApiTokenDetailResponseResponseBody: type: object properties: message: $ref: '#/components/schemas/MessageWithTokenResponse' content: $ref: '#/components/schemas/ApiTokenDetailResponseContentResponse' validationIssues: type: array items: $ref: '#/components/schemas/ValidationIssue' nullable: true additionalProperties: false ObjectResponseBody: type: object properties: message: $ref: '#/components/schemas/MessageWithTokenResponse' content: $ref: '#/components/schemas/ObjectContentResponse' validationIssues: type: array items: $ref: '#/components/schemas/ValidationIssue' nullable: true additionalProperties: false MessageWithTokenResponse: type: object properties: text: type: string token: type: string tokenArguments: type: array items: $ref: '#/components/schemas/ValidationIssueArgument' nullable: true additionalProperties: false ApiTokenDetailResponseContentResponse: type: object properties: data: $ref: '#/components/schemas/ApiTokenDetailResponse' metadata: $ref: '#/components/schemas/ContentMetadataResponse' additionalProperties: false ValidationIssue: type: object properties: field: type: string reason: type: string reasonToken: type: string reasonTokenArguments: type: array items: $ref: '#/components/schemas/ValidationIssueArgument' nullable: true additionalProperties: false ObjectContentResponse: type: object properties: data: nullable: true metadata: $ref: '#/components/schemas/ContentMetadataResponse' additionalProperties: false ValidationIssueArgument: type: object properties: name: type: string value: nullable: true additionalProperties: false ApiTokenDetailResponse: type: object properties: token: $ref: '#/components/schemas/ApiTokenSummaryResponse' organisationIds: type: array items: type: string description: Every organisation it reaches through a direct grant. coversWholeCustomer: type: boolean description: >- Whether it also holds account-wide access, which reaches every organisation the account owns, including ones added later. When true, `organisationIds` is not the whole picture and is usually empty. additionalProperties: false description: An API token and everything it reaches. ContentMetadataResponse: type: object properties: dateFormat: type: string dateTimeFormat: type: string paginationToken: type: string nullable: true additionalProperties: false ApiTokenSummaryResponse: type: object properties: clientId: type: string description: >- The credential's client id: what an integration exchanges for access tokens, and how the token is addressed on this API. name: type: string description: The display name you gave it. nullable: true createdDate: type: string description: When it was issued. nullable: true additionalProperties: false description: One API token as listed. No read model carries the secret. securitySchemes: X-Auth-Token: type: apiKey description: FlowPayroll JWT (raw token, no Bearer prefix) name: X-Auth-Token in: header ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.