Tokens

Manage access tokens for report sharing.

Overview

Tokens provide authenticated access to reports without requiring user login. They can be used for:

• Embedding reports in external applications
• Sharing reports with unauthenticated users
• API access with limited scope

Tokens can be local (server-side) or cloud-based (when cloud publishing is enabled).

GET /api/reports/{id}/tokens

Get all tokens associated with a report.

Authentication: Required

Path Parameters:

Parameter	Type	Description
id	string	Report ID

Response:

Local (and, when cloud is enabled, cloud) tokens scoped to this report, plus a warning set if the cloud lookup failed.

List report tokensGET /api/reports/admin:sales-overview/tokens

Local (and, when cloud is enabled, cloud) embed/run tokens scoped to this report. warning is set if the cloud lookup failed.

Response · 200

{
  "_links": {
    "self": {
      "href": "https://informer.example.com/api/reports/admin%3Asales-overview/tokens"
    }
  },
  "_embedded": {
    "inf:report-token": []
  }
}

Captured from the API examples test suite; ids and timestamps are normalized.

Response Fields:

Field	Type	Description
tokens	array	Array of token objects
warning	string	Localized message, present only when the cloud token lookup failed. Omitted on success. Deliberately generic: the underlying error detail stays in the server log rather than the response

Token Object Fields:

Field	Type	Description
id	string	Token UUID
type	string	Token type (usually "report")
typeName	string	Localized name of the token type
reportId	string	Associated report ID
key	string	The signed token string. Treat it as a credential
cloud	boolean	true for cloud tokens, false for local
notes	string	Free-text note recorded against the token
data	object	Type-specific settings, such as apiWhitelist
requests	number	Number of times the token has been used
lastAccessedAt	string	When the token was last used, null if never
expiresAt	string	Expiry timestamp, null if the token does not expire
createdAt	string	Creation timestamp

Cloud tokens carry the same fields, projected from the cloud service. Their _links.self points at the report-scoped delete route below rather than at /api/tokens/{id}.

Behavior:

1. Fetch local tokens - Retrieves tokens from the local database
2. Fetch cloud tokens - If cloud is enabled, requests tokens from cloud platform
3. Combine results - Returns both local and cloud tokens
4. Handle errors - If cloud lookup fails, returns local tokens with warning

Use Case:

View all access tokens for a report to manage sharing and revoke access if needed.

---

DELETE /api/reports/{id}/tokens/{tokenId}

Revoke a cloud token for this report. Local tokens have a database row and are revoked through DELETE /api/tokens/{id}; cloud tokens live in the cloud service, so this route proxies the delete on your behalf. The _links.self on each token in the GET response already points at the right one of the two.

Authentication: Required. Permissions: report:cloudPublish on the report.

Parameter	Type	Description
id	string	Report id
tokenId	string	Token id; must be a well-formed UUID

Response: 204 No Content. Cloud not enabled, unreachable, or refusing the delete answers 400 with the cloud service's message, never a 500.

---

Token Management

To create or manage local tokens, use the Token API endpoints:

• POST /api/tokens - Create a new token
• GET /api/tokens/{id} - Get token details
• DELETE /api/tokens/{id} - Revoke a local token (cloud tokens revoke through the report-scoped route above)

See the Token API documentation for full token management capabilities.

---

Cloud Publishing Tokens

When a report is published to the cloud (see Cloud Publishing), a cloud token is automatically created. Cloud tokens are marked with cloud: true:

{
  "cloud": true,
  "type": "report",
  "key": "eyJhbGciOi..."
}

The public link is built from the tenant's Cloud Base URL plus the token's key. The token object itself does not carry a ready-made URL.

---

Token Security

Best Practices:

• Tokens provide full access to the associated report
• Treat tokens as sensitive credentials
• Revoke tokens when they are no longer needed
• Use cloud tokens for public sharing
• Use local tokens for controlled API access
• Regularly audit token usage

Token Lifecycle:

1. Creation - Token is generated with random string
2. Active Use - Token provides access to report
3. Revocation - Token is deleted and becomes invalid
4. Cleanup - Unused tokens should be removed periodically

---

Using Tokens

API Access

# Access report with token
curl -H "Authorization: Bearer {token}" \
  https://api.informer.com/api/reports/team:sales-dashboard

URL Parameters

https://app.informer.com/v/report.html?token={token}

Embed Code

<iframe src="https://cloud.informer.com/view/{token}"
        width="100%" height="600px">
</iframe>

---

Related Endpoints

• Cloud Publishing - Publish reports with public tokens
• POST /api/reports/{id}/_cloud-publish - Creates cloud token automatically
• Token API - Full token CRUD operations