Lists organization API tokens. Secrets are last-4 only. Permission: `tokens`.

SDK `tokens.list()` takes no args. HTTP accepts optional `?limit=` to slice the list.

## Query Parameters

| Name | Type | Description |
| ---- | ---- | ----------- |
| `limit` | integer | Optional slice. When the org has more tokens than `limit`, `has_more` is `true`. |

## Response Fields

| Field | Type | Description |
| ----- | ---- | ----------- |
| `object` | `"list"` | Discriminator. Always `list`. |
| `has_more` | boolean | `true` when `limit` truncated the list. |
| `data` | array | Token summaries: `id`, `name`, `last4`, `permissions`, `createdAt`. |

## Errors

| Status | `name` | When |
| ------ | ------ | ---- |
| 401 | `missing_api_key` | Missing or invalid bearer token |
| 403 | `missing_permission` | Token lacks the `tokens` permission |

## Related

- [Create Token](/docs/api-reference/v2/tokens-create)
- [SDK: lumail.tokens.list](/docs/sdk/v2/tokens-list)


## API Reference
**Method:** GET
**Endpoint:** /api/v2/tokens

### SDK
```ts
import { Lumail } from "lumail";

const lumail = new Lumail({ apiKey: process.env.LUMAIL_API_KEY });
const { data, error } = await lumail.tokens.list();
if (error) {
  throw error;
}

for (const token of data.data) {
  console.log(token.id, token.last4);
}
```

### cURL
```bash
curl "https://lumail.io/api/v2/tokens?limit=20" \
  -H "Authorization: Bearer YOUR_API_TOKEN"
```

### JavaScript
```javascript
const response = await fetch("https://lumail.io/api/v2/tokens?limit=20", {
  headers: {
    Authorization: "Bearer YOUR_API_TOKEN",
  },
});
const page = await response.json();
```

### Success Response
```json
{
  "object": "list",
  "has_more": false,
  "data": [
    {
      "id": "tok_abc123",
      "name": "CI",
      "last4": "a1b2",
      "permissions": ["subscribers", "emails", "audience"],
      "createdAt": "2026-09-05T10:30:00.000Z"
    }
  ]
}
```

### Error Response
```json
{
  "name": "missing_permission",
  "message": "Missing permission: tokens",
  "statusCode": 403
}
```