# Service Token Permissions

Source: https://userguide.qualytics.io/settings/access-tokens/service-token/deep-dive/permissions/

This page covers the roles and permissions required to view and manage Service Tokens.

> **Note: Workspace-Level Only**
>
> Token management is a global platform feature — it is not scoped to individual datastores or teams. Unlike datastore features that use two permission layers (User Roles + Team Permissions), token operations are controlled **exclusively by User Roles**. Team Permissions do not apply.

## User Roles (Workspace-Level)

Only users with the **Admin** role can view and manage Service Tokens. All Service Token operations are administrator-controlled.

| Action | Member | Manager | Admin |
| --- | --- | --- | --- |
| See the Service tab in Access Tokens | Not allowed | Not allowed | Allowed |
| View all Service Tokens | Not allowed | Not allowed | Allowed |
| Generate Service Token | Not allowed | Not allowed | Allowed |
| Revoke Service Token | Not allowed | Not allowed | Allowed |
| Restore Service Token | Not allowed | Not allowed | Allowed |
| Delete Service Token | Not allowed | Not allowed | Allowed |
| Create SCIM Administration Token | Not allowed | Not allowed | Allowed |

## UI Behavior Without Permission

| Scenario | What the User Sees |
| --- | --- |
| User has **Member** or **Manager** role | The **Service** tab is hidden. The user cannot see or manage Service Tokens. |
| User has **Admin** role | Both **Personal** and **Service** tabs are visible. The token form shows the Type selector (Personal/Service), Service User picker, Expiration, and SCIM Administration Token checkbox. |

## API Permissions

| Endpoint | Method | Required Role | Description |
| --- | --- | --- | --- |
| `/user-tokens/service` | GET | Admin | List all Service Tokens across all Service Users. |
| `/user-tokens` | POST | Admin | Create a Service Token (when `user_id` is provided). |
| `/user-tokens/{id}` | PUT | Admin | Revoke or restore any Service Token. |
| `/user-tokens/{id}` | DELETE | Admin | Delete any Service Token (must be revoked or expired). |

## Constraints

- **Token names must be unique per Service User** — duplicate names return a conflict error (409).
- **Active tokens cannot be deleted**: you must revoke a token before you can delete it. Expired tokens can be deleted without being revoked.
- **Service Tokens can only be created for Service Users** — attempting to assign a Service Token to a regular user account returns an error.
- **Internal users are blocked** — system internal users cannot be targeted for token operations.

> **Info: Personal Token Permissions**
>
> For permissions related to Personal Access Tokens (self-service, Member role), see the [Personal Token Permissions](https://userguide.qualytics.io/settings/access-tokens/personal-token/deep-dive/permissions/) page.

> **Info: Full User Roles Reference**
>
> For the complete User Roles matrix across all Qualytics features, see the [User Roles](https://userguide.qualytics.io/settings/access/users/roles/overview/) page.

*Last updated: November 13, 2026.*