---
# @generated by sylphx-gen. Do not edit.
title: "List token exchanges"
description: "`broker.token_exchanges.list` (GET /v1/{parent}/token_exchanges): Lists the credentials issued under a trust policy, newest first."
type: reference
product: platform
summary: "Lists the credentials issued under a trust policy, newest first."
updated: 2026-09-28
nav: false
---

Lists the credentials issued under a trust policy, newest first.

- **Path** `GET https://api.sylphx.com/v1/orgs/acme/trust_policies/trust-policy/token_exchanges`
- **Scope** `broker:read`
- **Effect** `read` — nothing is written.
- **Collection** [token_exchanges](/docs/api/token_exchanges)
- **Query** `page_size`, `page_token`
- **Pagination** the answer carries `token_exchanges` and, when there is more, `next_page_token`

## Request

| Field | Type | What it is |
| --- | --- | --- |
| `parent` | `string` | The trust policy to list under. Required. |
| `page_size` | `int32` | At most this many; default 50, clamped to 1000. |
| `page_token` | `string` | `next_page_token` of the previous page. |

## Response

| Field | Type | What it is |
| --- | --- | --- |
| `token_exchanges` | `TokenExchange[]` | The page, newest first. |
| `next_page_token` | `string` | The token of the next page; empty on the last page. |

### TokenExchange

| Field | Type | What it is |
| --- | --- | --- |
| `name` | `string` | `orgs/{org}/trust_policies/{trust_policy}/token_exchanges/{token_exchange}`. |
| `uid` | `string` | `tkx_<cell><ulid>`; also the `{token_exchange}` id. Output only. |
| `meta` | `ResourceMeta` | Resource metadata. |
| `subject` | `string` | The accountable principal, `orgs/{org}/principals/{id}`. Output only. |
| `actor` | `string` | The Agent the subject's delegated grant acted for; empty when the subject exchanged for itself. Output only. |
| `repository` | `string` | The one repository the credential covers, `owner/name`. Output only. |
| `permissions` | `map<string, string>` | The permissions the credential carries. Output only. |
| `credential_kind` | `CredentialKind` | What the credential is. Output only. One of `access_token`, `runner_registration`. |
| `create_time` | `timestamp` | When it was issued. Output only. |
| `expire_time` | `timestamp` | When the provider stops honoring it. Output only. |
| `revoke_time` | `timestamp` | When the provider confirmed it revoked; unset while live or when it simply expired. Output only. |
| `token_sha256` | `string` | Lowercase hex SHA-256 of the credential, to match a credential seen elsewhere to its record. Output only. |
| `connection` | `string` | The Connection the credential was issued on. Output only. |
| `issuer` | `string` | The provider identity that signed it: for GitHub, `github-apps/{app_id}`. Output only. |

### ResourceMeta

| Field | Type | What it is |
| --- | --- | --- |
| `generation` | `int64` | Increases by one on every change to `spec`. Output only. |
| `etag` | `string` | Strong ETag (AIP-154): changes on any change to spec, status, or metadata. Send it back as `If-Match` or `etag` to make Update and Delete conditional; a mismatch fails with ABORTED / 409 `ETAG_MISMATCH`. Output only. |
| `create_time` | `timestamp` | When the Resource was created. Output only. |
| `update_time` | `timestamp` | When the Resource last changed. Output only. |
| `delete_time` | `timestamp` | Set while the Resource is being deleted. Output only. |
| `labels` | `map<string, string>` | Caller-writable, indexed labels (AIP-122 label rules). |
| `annotations` | `map<string, string>` | Caller-writable, unindexed annotations. |
| `display_name` | `string` | Caller-writable human-readable name. |
| `creator` | `string` | The principal that created the Resource. Output only. |

## Errors

- [`UNAUTHENTICATED`](/docs/api/errors/UNAUTHENTICATED) — No valid key or token was presented.
- [`PERMISSION_DENIED`](/docs/api/errors/PERMISSION_DENIED) — The key lacks the method's permission.
- [`INVALID_FIELD`](/docs/api/errors/INVALID_FIELD) — A field failed validation.
- [`PAGE_TOKEN_MISMATCH`](/docs/api/errors/PAGE_TOKEN_MISMATCH) — A page token was reused with different parameters.

Every error arrives in the body [Errors](/docs/platform/errors) describes.

## Examples

**cURL**

```curl
curl "https://api.sylphx.com/v1/orgs/acme/trust_policies/trust-policy/token_exchanges" \
  -H "Authorization: Bearer $SYLPHX_API_KEY"
```

**TypeScript**

```ts
const response = await sylphx.broker.tokenExchanges.list({ parent: 'orgs/acme/trust_policies/trust-policy' })
```

**Rust**

```rust
let mut req = sylphx::broker::ListTokenExchangesRequest::default();
req.parent = "orgs/acme/trust_policies/trust-policy".to_string();
let response = sx.broker().token_exchanges().list(req).await?;
```

**CLI**

```bash
sylphx broker token-exchanges list orgs/acme/trust_policies/trust-policy
```

**MCP**

```json
{ "method_id": "broker.token_exchanges.list", "args": {"parent":"orgs/acme/trust_policies/trust-policy"} }
```