---
title: CRUD Operations
url: https://docs.kaltura.com/docs/getting-started/authentication/app-tokens-crud
---

## AppToken CRUD Operations

### appToken.add — Create a Token

```
POST /api_v3/service/appToken/action/add
```

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `ks` | string | Yes | Admin KS |
| `appToken[objectType]` | string | Yes | `KalturaAppToken` |
| `appToken[hashType]` | string | No | `SHA256` (recommended), `SHA1`, `SHA512`, `MD5`. Default: `SHA1`. Immutable after creation. |
| `appToken[sessionType]` | int | No | `0`=USER (recommended), `2`=ADMIN |
| `appToken[sessionDuration]` | int | No | Max session duration in seconds (0 = account default) |
| `appToken[sessionPrivileges]` | string | No | Privileges to bake in (e.g., `sview:*,list:*`) |
| `appToken[sessionUserId]` | string | No | Fixed user ID for all sessions created from this token |
| `appToken[description]` | string | No | Human-readable label |
| `appToken[expiry]` | int | No | Unix timestamp when token expires (0 = never) |

```bash
curl -X POST "$KALTURA_SERVICE_URL/service/appToken/action/add" \
  -d "ks=$KALTURA_KS" \
  -d "format=1" \
  -d "appToken[objectType]=KalturaAppToken" \
  -d "appToken[hashType]=SHA256" \
  -d "appToken[sessionType]=0" \
  -d "appToken[sessionDuration]=86400" \
  -d "appToken[sessionPrivileges]=sview:*,list:*" \
  -d "appToken[description]=My integration token"
```

**Response:**
```json
{
  "id": "1_abc123def4",
  "token": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2",
  "partnerId": 123456,
  "status": 2,
  "sessionType": 0,
  "sessionDuration": 86400,
  "sessionPrivileges": "sview:*,list:*",
  "sessionUserId": "",
  "hashType": "SHA256",
  "description": "My integration token",
  "expiry": 0,
  "createdAt": 1700000000,
  "updatedAt": 1700000000,
  "objectType": "KalturaAppToken"
}
```

The response includes `id` (token ID) and `token` (the secret value — store securely on your backend server only). The `token` field is a hex string whose length depends on the hash algorithm (64 characters for SHA256).

### appToken.get — Retrieve a Token

```
POST /api_v3/service/appToken/action/get
```

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `ks` | string | Yes | Admin KS |
| `id` | string | Yes | The AppToken ID |

Returns the full `KalturaAppToken` object. The `token` field is included only for the account admin.

```bash
curl -X POST "$KALTURA_SERVICE_URL/service/appToken/action/get" \
  -d "ks=$KALTURA_KS" \
  -d "format=1" \
  -d "id=$APP_TOKEN_ID"
```

**Response:**
```json
{
  "id": "1_abc123def4",
  "token": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2",
  "partnerId": 123456,
  "status": 2,
  "sessionType": 0,
  "sessionDuration": 86400,
  "sessionPrivileges": "sview:*,list:*",
  "sessionUserId": "",
  "hashType": "SHA256",
  "description": "My integration token",
  "expiry": 0,
  "createdAt": 1700000000,
  "updatedAt": 1700000000,
  "objectType": "KalturaAppToken"
}
```

### appToken.list — List All Tokens

```
POST /api_v3/service/appToken/action/list
```

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `ks` | string | Yes | Admin KS |
| `filter[statusEqual]` | int | No | Filter by status (`2`=ACTIVE) |
| `filter[hashTypeEqual]` | string | No | Filter by hash type |
| `filter[sessionTypeEqual]` | int | No | Filter by session type |
| `filter[idEqual]` | string | No | Filter by specific token ID |
| `pager[pageSize]` | int | No | Results per page (default 30) |
| `pager[pageIndex]` | int | No | Page number (1-based) |

```bash
curl -X POST "$KALTURA_SERVICE_URL/service/appToken/action/list" \
  -d "ks=$KALTURA_KS" \
  -d "format=1" \
  -d "filter[statusEqual]=2" \
  -d "pager[pageSize]=10"
```

**Response:**
```json
{
  "objects": [
    {
      "id": "1_abc123def4",
      "partnerId": 123456,
      "status": 2,
      "sessionType": 0,
      "sessionDuration": 86400,
      "sessionPrivileges": "sview:*,list:*",
      "hashType": "SHA256",
      "description": "My integration token",
      "expiry": 0,
      "createdAt": 1700000000,
      "updatedAt": 1700000000,
      "objectType": "KalturaAppToken"
    }
  ],
  "totalCount": 1,
  "objectType": "KalturaAppTokenListResponse"
}
```

The `token` field is included in list results only for the account admin.

### appToken.update — Modify a Token

```
POST /api_v3/service/appToken/action/update
```

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `ks` | string | Yes | Admin KS |
| `id` | string | Yes | The AppToken ID |
| `appToken[objectType]` | string | Yes | `KalturaAppToken` |
| `appToken[description]` | string | No | Updated description |
| `appToken[sessionDuration]` | int | No | Updated max session duration |
| `appToken[sessionPrivileges]` | string | No | Updated privileges |
| `appToken[sessionUserId]` | string | No | Updated fixed user ID |

> `hashType` and `sessionType` are set at creation and locked. To use a different hash algorithm or session type, create a new token.

```bash
curl -X POST "$KALTURA_SERVICE_URL/service/appToken/action/update" \
  -d "ks=$KALTURA_KS" \
  -d "format=1" \
  -d "id=$APP_TOKEN_ID" \
  -d "appToken[objectType]=KalturaAppToken" \
  -d "appToken[description]=Updated integration token" \
  -d "appToken[sessionDuration]=43200"
```

**Response:** The updated `KalturaAppToken` object:
```json
{
  "id": "1_abc123def4",
  "partnerId": 123456,
  "status": 2,
  "sessionType": 0,
  "sessionDuration": 43200,
  "sessionPrivileges": "sview:*,list:*",
  "hashType": "SHA256",
  "description": "Updated integration token",
  "createdAt": 1700000000,
  "updatedAt": 1700001000,
  "objectType": "KalturaAppToken"
}
```

### appToken.delete — Revoke a Token

```
POST /api_v3/service/appToken/action/delete
```

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `ks` | string | Yes | Admin KS |
| `id` | string | Yes | The AppToken ID to delete |

```bash
curl -X POST "$KALTURA_SERVICE_URL/service/appToken/action/delete" \
  -d "ks=$KALTURA_KS" \
  -d "format=1" \
  -d "id=$APP_TOKEN_ID"
```

**Response:** Empty response on success. The token's status changes to `3` (DELETED).

Immediately revokes the token. Existing KS sessions already issued from this token remain valid until their TTL expires; revoke those with `session.end` if needed.