List provisioning tokens (provider only)
Returns the organization's provisioning tokens, newest first, with each token's prefix, class, status, expiry and enrollment count. The secret is never shown. A token that can still enroll is always listed. Expired, exhausted and revoked tokens stay listed until 6 days after they expire, then fall out.
Required permission
Requires the provider.read permission. See Permissions for the roles and API key permissions that include it.
Command line
The orl CLI wraps this endpoint:
orl provider provisioning-token listapiKeyAuthorizationBearer <token>OpenRelay API key. Send it as Authorization: Bearer or_… (legacy vl_… keys still work).
orgId*stringOK
application/json- response
[index: integer]?curl -X GET 'https://api.openrelay.inc/v1/orgs/string/provider/tokens'[ { "id": "string", "tokenPrefix": "string", "name": "string", "nodeType": "string", "status": "string", "createdAt": "string", "expiresAt": "string", "enrollmentCount": 0, "noticeSeconds": 0, "maxEnrollments": 0, "lastUsedAt": "string", "nodePool": "string", "revokedAt": "string" }]Submit a provider application POST
Submits the organization's application to become a provider, with a required note. Answers 400 if it is already a provider or has an application pending.
Generate a provisioning token (provider only) POST
Mints a provisioning token for enrolling nodes and returns its secret, shown only once. A persistent token enrolls any number of nodes for 24 hours. An interruptible token (class interruptible) lives 30 days and enrolls at most maxEnrollments nodes. A legacy API key needs clusters:write.