---
title: List resource tokens
description: Use the influxdb3 CLI or the HTTP API to list resource tokens with fine-grained access permissions in your InfluxDB 3 Enterprise instance. Use the influxdb3 show tokens command to list all tokens or use SQL to query token metadata directly from the system.tokens table.
url: https://docs.influxdata.com/influxdb3/enterprise/admin/tokens/resource/list/
estimated_tokens: 3573
product: InfluxDB 3 Enterprise
version: enterprise
---

# List resource tokens

Use the `influxdb3` CLI or the HTTP API to list resource tokens with fine-grained access permissions in your InfluxDB 3 Enterprise instance. Use the `influxdb3 show tokens` command to list all tokens or use SQL to query token metadata directly from the `system.tokens` table.

Resource tokens have fine-grained permissions for InfluxDB 3 resources, such as databases and system tables. The permissions are in the format `RESOURCE_TYPE:RESOURCE_NAMES:ACTIONS`.

-   `RESOURCE_TYPE` is the type of resource (for example, `db`, `system`)
-   `RESOURCE_NAMES` is the specific resource name (for example, a list of database names or `*` for all)
-   `ACTIONS` is the permission level (`read`, `write`, or `*` for all)

Database resource tokens have permissions in the format `db:database_names:actions`. System resource tokens have permissions in the format `system:system_endpoint_names:read`.

\_In the following examples, replace `AUTH_TOKEN` with your InfluxDB [token](/influxdb3/enterprise/admin/tokens/)

that has read permission on the `_internal` system database .\_

## List all tokens

The `influxdb3 show tokens` CLI command lists all admin and resource tokens in your InfluxDB 3 instance.

```bash
influxdb3 show tokens
```

## Query token metadata

To filter tokens and retrieve specific details using SQL, query the `system.tokens` table in the `_internal` system database–for example:

<!-- Tabbed content: Select one of the following options -->

**CLI:**

```bash
influxdb3 query \
  --db _internal \
  "SELECT name, permissions FROM system.tokens WHERE permissions  NOT LIKE '\*%'"
```

**HTTP API:**

```bash
curl -G \
"http://localhost:8181/api/v3/query_sql" \
--data-urlencode "db=_internal" \
--data-urlencode "q=SELECT * FROM system.tokens WHERE permissions NOT LIKE '\*%'" \
--header 'Accept: application/json' \
--header "Authorization: Bearer AUTH_TOKEN" 
```

<!-- End tabbed content -->

## Format the output

Use the format option to specify the output format for the `influxdb3 show tokens` command or the HTTP API response.

InfluxDB 3 Enterprise supports the following output formats:

-   `pretty` *(default for CLI)*
-   `json` *(default for HTTP API)*
-   `jsonl`
-   `csv`
-   `parquet` *([output to a file](#output-to-a-parquet-file))*

<!-- Tabbed content: Select one of the following options -->

**CLI:**

```bash
influxdb3 show tokens \
  --format csv
```

**HTTP API:**

```bash
curl -G \
  "http://localhost:8181/api/v3/query_sql" \
  --data-urlencode "db=_internal" \
  --data-urlencode "q=SELECT * FROM system.tokens" \
  --data-urlencode "format=csv" \
  --header 'Accept: text/csv' \
  --header "Authorization: Bearer AUTH_TOKEN"
```

<!-- End tabbed content -->

### Output to a Parquet file

[Parquet](https://parquet.apache.org/) is a binary format.

To output to a Parquet file using the CLI, include the `--output` option with a destination path for the file.

To output a Parquet file using the HTTP API, your client must be able to handle binary data–for example, using cURL’s `--output` option.

<!-- Tabbed content: Select one of the following options -->

**CLI:**

```bash
influxdb3 show tokens \
  --format parquet \
  --output /PATH/TO/FILE.parquet
```

**HTTP API:**

```bash
curl -G \
  "http://localhost:8181/api/v3/query_sql" \
  --data-urlencode "db=_internal" \
  --data-urlencode "q=SELECT * FROM system.tokens" \
  --data-urlencode "format=parquet" \
  --header "Accept: application/parquet" \
  --header "Authorization: Bearer AUTH_TOKEN" \
  --output /PATH/TO/FILE.parquet
```

<!-- End tabbed content -->

Replace `/PATH/TO/FILE.parquet` with the path to the file where you want to save the Parquet data.

## Filter the output for resource tokens

You can use tools such as `grep` or `jq` to filter the token list–for example:

Use `grep` to filter for resource (non-admin) tokens:

<!-- Tabbed content: Select one of the following options -->

**CLI:**

```bash
influxdb3 show tokens --format pretty | grep -v '*:*:*'
```

**HTTP API:**

```bash
curl -G \
  "http://localhost:8181/api/v3/query_sql" \
  --data-urlencode "db=_internal" \
  --data-urlencode "q=SELECT * FROM system.tokens" \
  --data-urlencode "format=jsonl" \
  --header 'Accept: application/json' \
  --header "Authorization: Bearer AUTH_TOKEN" |
grep -v "*:*:*"
```

<!-- End tabbed content -->

Use `jq` to filter for system tokens and display their permissions:

<!-- Tabbed content: Select one of the following options -->

**CLI:**

```bash
influxdb3 show tokens --format json |
jq '.[] | select(.permissions | startswith("system:")) | {name: .name, permissions: .permissions}'
```

**HTTP API:**

```bash
curl -G \
  "http://localhost:8181/api/v3/query_sql" \
  --data-urlencode "db=_internal" \
  --data-urlencode "q=SELECT * FROM system.tokens" \
  --data-urlencode "format=json" \
  --header "Accept: application/json" \
  --header "Authorization: Bearer AUTH_TOKEN" |
jq '.[] | select(.permissions | startswith("system:")) | {name: .name, permissions: .permissions}'
```

<!-- End tabbed content -->

#### Related

-   [InfluxDB HTTP API](/influxdb3/enterprise/reference/api/)