---
title: List resource tokens
description: Use the influxdb3 CLI or the HTTP API to list resource tokens with fine-grained access permissions in your InfluxDB 3 Enterprise instance. Use the influxdb3 show tokens command to list all tokens or use SQL to query token metadata directly from the system.tokens table.
url: https://docs.influxdata.com/influxdb3/enterprise/admin/tokens/resource/list/
estimated_tokens: 1220
product: InfluxDB 3 Enterprise
version: enterprise
publisher: InfluxData
canonical: https://docs.influxdata.com/influxdb3/enterprise/admin/tokens/resource/list/
date: '2026-05-15T15:46:14-06:00'
lastmod: '2026-05-15T15:46:14-06:00'
---

Use the `influxdb3` CLI or the HTTP API to list resource tokens with fine-grained
access permissions in your InfluxDB 3 Enterprise instance.
Use the `influxdb3 show tokens` command to list all tokens or use SQL to query token
metadata directly from the `system.tokens` table.

Resource tokens have fine-grained permissions for InfluxDB 3 resources, such
as databases and system tables.
The permissions are in the format `RESOURCE_TYPE:RESOURCE_NAMES:ACTIONS`.

* `RESOURCE_TYPE` is the type of resource (for example, `db`, `system`)
* `RESOURCE_NAMES` is the specific resource name (for example, a list of database names or `*` for all)
* `ACTIONS` is the permission level (`read`, `write`, or `*` for all)

Database resource tokens have permissions in the format `db:database_names:actions`.
System resource tokens have permissions in the format `system:system_endpoint_names:read`.

\_In the following examples, replace `AUTH_TOKEN`with your InfluxDB [token](/influxdb3/enterprise/admin/tokens/)

that has read permission on the `_internal` system database
.\_

## List all tokens

The `influxdb3 show tokens` CLI command lists all admin and resource tokens in your InfluxDB 3 instance.

```bash
influxdb3 show tokens
```

## Query token metadata

To filter tokens and retrieve specific details using SQL, query the `system.tokens` table in the`_internal` system database–for example:

[CLI](#cli-filter-in-query)[HTTP API](#http-api-filter-in-query)

```bash
influxdb3 query \
  --db _internal \
  "SELECT name, permissions FROM system.tokens WHERE permissions  NOT LIKE '\*%'"
```

```bash
curl -G \
"http://localhost:8181/api/v3/query_sql" \
--data-urlencode "db=_internal" \
--data-urlencode "q=SELECT * FROM system.tokens WHERE permissions NOT LIKE '\*%'" \
--header 'Accept: application/json' \
--header "Authorization: Bearer AUTH_TOKEN"
```

## Format the output

Use the format option to specify the output format for
the `influxdb3 show tokens` command or the HTTP API response.

InfluxDB 3 Enterprise supports the following output formats:

* `pretty` *(default for CLI)*
* `json` *(default for HTTP API)*
* `jsonl`
* `csv`
* `parquet` *([output to a file](#output-to-a-parquet-file))*

[CLI](#format-using-the-cli)[HTTP API](#format-using-the-api)

```bash
influxdb3 show tokens \
  --format csv
```

```bash
curl -G \
  "http://localhost:8181/api/v3/query_sql" \
  --data-urlencode "db=_internal" \
  --data-urlencode "q=SELECT * FROM system.tokens" \
  --data-urlencode "format=csv" \
  --header 'Accept: text/csv' \
  --header "Authorization: Bearer AUTH_TOKEN"
```

### Output to a Parquet file

[Parquet](https://parquet.apache.org/) is a binary format.

To output to a Parquet file using the CLI, include the `--output` option
with a destination path for the file.

To output a Parquet file using the HTTP API, your client must be able to handle binary data–for example,
using cURL’s `--output` option.

[CLI](#cli-output-to-parquet)[HTTP API](#http-api-output-to-parquet)

```bash
influxdb3 show tokens \
  --format parquet \
  --output /PATH/TO/FILE.parquet
```

```bash
curl -G \
  "http://localhost:8181/api/v3/query_sql" \
  --data-urlencode "db=_internal" \
  --data-urlencode "q=SELECT * FROM system.tokens" \
  --data-urlencode "format=parquet" \
  --header "Accept: application/parquet" \
  --header "Authorization: Bearer AUTH_TOKEN" \
  --output /PATH/TO/FILE.parquet
```

Replace `/PATH/TO/FILE.parquet`with the path to the file where you want to save the Parquet data.

## Filter the output for resource tokens

You can use tools such as `grep` or `jq` to filter the token list–for example:

Use `grep` to filter for resource (non-admin) tokens:

[CLI](#cli-filter-output-using-grep)[HTTP API](#list-tokens-using-the-api)

```bash
influxdb3 show tokens --format pretty | grep -v '*:*:*'
```

```bash
curl -G \
  "http://localhost:8181/api/v3/query_sql" \
  --data-urlencode "db=_internal" \
  --data-urlencode "q=SELECT * FROM system.tokens" \
  --data-urlencode "format=jsonl" \
  --header 'Accept: application/json' \
  --header "Authorization: Bearer AUTH_TOKEN" |
grep -v "*:*:*"
```

Use `jq` to filter for system tokens and display their permissions:

[CLI](#filter-output-using-the-cli)[HTTP API](#filter-output-using-the-api)

```bash
influxdb3 show tokens --format json |
jq '.[] | select(.permissions | startswith("system:")) | {name: .name, permissions: .permissions}'
```

```bash
curl -G \
  "http://localhost:8181/api/v3/query_sql" \
  --data-urlencode "db=_internal" \
  --data-urlencode "q=SELECT * FROM system.tokens" \
  --data-urlencode "format=json" \
  --header "Accept: application/json" \
  --header "Authorization: Bearer AUTH_TOKEN" |
jq '.[] | select(.permissions | startswith("system:")) | {name: .name, permissions: .permissions}'
```

#### Related

* [InfluxDB HTTP API](/influxdb3/enterprise/reference/api/)