List resource tokens

Use the influxdb3 CLI or the HTTP API to list resource tokens with fine-grained access permissions in your InfluxDB 3 Enterprise instance. Use the influxdb3 show tokens command to list all tokens or use SQL to query token metadata directly from the system.tokens table.

Resource tokens have fine-grained permissions for InfluxDB 3 resources, such as databases and system tables. The permissions are in the format RESOURCE_TYPE:RESOURCE_NAMES:ACTIONS.

• RESOURCE_TYPE is the type of resource (for example, db, system)
• RESOURCE_NAMES is the specific resource name (for example, a list of database names or * for all)
• ACTIONS is the permission level (read, write, or * for all)

Database resource tokens have permissions in the format db:database_names:actions. System resource tokens have permissions in the format system:system_endpoint_names:read.

In the following examples, replace AUTH_TOKEN with your InfluxDB token that has read permission on the _internal system database.

List all tokens

The influxdb3 show tokens CLI command lists all admin and resource tokens in your InfluxDB 3 instance.

influxdb3 show tokens

Query token metadata

To filter tokens and retrieve specific details using SQL, query the system.tokens table in the _internal system database–for example:

influxdb3 query \
  --db _internal \
  "SELECT name, permissions FROM system.tokens WHERE permissions  NOT LIKE '\*%'"

curl -G \
"http://localhost:8181/api/v3/query_sql" \
--data-urlencode "db=_internal" \
--data-urlencode "q=SELECT * FROM system.tokens WHERE permissions NOT LIKE '\*%'" \
--header 'Accept: application/json' \
--header "Authorization: Bearer 
AUTH_TOKEN
" 

Format the output

Use the format option to specify the output format for the influxdb3 show tokens command or the HTTP API response.

InfluxDB 3 Enterprise supports the following output formats:

• pretty (default for CLI)
• json (default for HTTP API)
• jsonl
• csv
• parquet (output to a file)

influxdb3 show tokens \
  --format csv

curl -G \
  "http://localhost:8181/api/v3/query_sql" \
  --data-urlencode "db=_internal" \
  --data-urlencode "q=SELECT * FROM system.tokens" \
  --data-urlencode "format=csv" \
  --header 'Accept: text/csv' \
  --header "Authorization: Bearer 
AUTH_TOKEN
"

Output to a Parquet file

Parquet is a binary format.

To output to a Parquet file using the CLI, include the --output option with a destination path for the file.

To output a Parquet file using the HTTP API, your client must be able to handle binary data–for example, using cURL’s --output option.

influxdb3 show tokens \
  --format parquet \
  --output 
/PATH/TO/FILE.parquet

curl -G \
  "http://localhost:8181/api/v3/query_sql" \
  --data-urlencode "db=_internal" \
  --data-urlencode "q=SELECT * FROM system.tokens" \
  --data-urlencode "format=parquet" \
  --header "Accept: application/parquet" \
  --header "Authorization: Bearer 
AUTH_TOKEN
" \
  --output 
/PATH/TO/FILE.parquet

Replace /PATH/TO/FILE.parquet with the path to the file where you want to save the Parquet data.

Filter the output for resource tokens

You can use tools such as grep or jq to filter the token list–for example:

Use grep to filter for resource (non-admin) tokens:

influxdb3 show tokens --format pretty | grep -v '*:*:*'

curl -G \
  "http://localhost:8181/api/v3/query_sql" \
  --data-urlencode "db=_internal" \
  --data-urlencode "q=SELECT * FROM system.tokens" \
  --data-urlencode "format=jsonl" \
  --header 'Accept: application/json' \
  --header "Authorization: Bearer 
AUTH_TOKEN
" |
grep -v "*:*:*"

Use jq to filter for system tokens and display their permissions:

influxdb3 show tokens --format json |
jq '.[] | select(.permissions | startswith("system:")) | {name: .name, permissions: .permissions}'

curl -G \
  "http://localhost:8181/api/v3/query_sql" \
  --data-urlencode "db=_internal" \
  --data-urlencode "q=SELECT * FROM system.tokens" \
  --data-urlencode "format=json" \
  --header "Accept: application/json" \
  --header "Authorization: Bearer 
AUTH_TOKEN
" |
jq '.[] | select(.permissions | startswith("system:")) | {name: .name, permissions: .permissions}'