UserLoginTokens

Introduction

UserLoginTokens are short-lived, one-time credentials that let a browser sign in a User without entering that user's password. See User Login Token for the browser login flow.

The signed token is returned only when the record is created. Store or forward it securely because list and show responses cannot retrieve it later.

Model Definition

Relations

Key	Relation	Type	Relation Field(s)
user	User	Belongs to	user_id
loginUser	User	Belongs to	login_user_id

Tokens use UUIDs, expire at expires_at, and are soft-deleted after use or explicit deletion.

Admin: List

List all UserLoginTokens in administration scope.

Definition

GET /api/administration/users/login-tokens

Request Keys

Key	Type	Default	Description
selects	string	All fields except the internal ID	Comma-separated fields to return.
relations	string	Default relations	Pipe-separated relations to include.
limit	integer	No limit	Maximum number of records.

Behavior

The administration list includes soft-deleted tokens. The secret token is never returned.

Example Request

PHP

$client = new GuzzleHttp\Client(['base_uri' => 'https://{tenant}.intratool.de']);
$response = $client->request('GET', '/api/administration/users/login-tokens', [
    'headers' => ['Authorization' => "Bearer {accessToken}"]
]);

Example Response

[
  {
    "uuid": "4dcc0220-45b8-4e96-bae1-cb645cc49965",
    "user_id": 7,
    "login_user_id": 8,
    "expires_at": "2026-08-06 11:05:00",
    "created_at": "2026-08-06 11:00:00",
    "updated_at": "2026-08-06 11:00:00",
    "deleted_at": null
  },
  {
    "uuid": "c4d1d6d0-1ea0-4b25-9a26-07951f495c43",
    "user_id": 7,
    "login_user_id": 19,
    "expires_at": "2026-08-06 12:00:00",
    "created_at": "2026-08-06 10:00:00",
    "updated_at": "2026-08-06 10:12:00",
    "deleted_at": "2026-08-06 10:12:00"
  }
]

Admin: Show

Show one UserLoginToken in administration scope.

Definition

GET /api/administration/users/login-tokens/{userLoginToken}

Route Parameters

Parameter	Type	Description
userLoginToken	UUID	UserLoginToken UUID.

Request Keys

Key	Type	Default	Description
selects	string	All fields except the internal ID	Comma-separated fields to return.
relations	string	Default relations	Pipe-separated relations to include.

Example Request

PHP

$client = new GuzzleHttp\Client(['base_uri' => 'https://{tenant}.intratool.de']);
$response = $client->request('GET', '/api/administration/users/login-tokens/4dcc0220-45b8-4e96-bae1-cb645cc49965', [
    'headers' => ['Authorization' => "Bearer {accessToken}"]
]);

Example Response

{
  "uuid": "4dcc0220-45b8-4e96-bae1-cb645cc49965",
  "user_id": 7,
  "login_user_id": 8,
  "expires_at": "2026-08-06 11:05:00",
  "created_at": "2026-08-06 11:00:00",
  "updated_at": "2026-08-06 11:00:00",
  "deleted_at": null
}

Admin: Create by User ID

Create a UserLoginToken for one user ID.

Definition

POST /api/administration/users/login-tokens

Request Keys

Key	Type	Default	Description
login_user_id*	integer	-	Active, non-internal User to sign in.
expires_in*	integer	-	Lifetime in seconds, from 1 through 86400.

Keys with * are required.

Behavior

user_id is always taken from the authenticated user and cannot be overridden. The example's 300-second lifetime produces the shown expires_at value from the creation time.

Example Request

PHP

$client = new GuzzleHttp\Client(['base_uri' => 'https://{tenant}.intratool.de']);
$response = $client->request('POST', '/api/administration/users/login-tokens', [
    'headers' => ['Authorization' => "Bearer {accessToken}"],
    'json' => [
        'login_user_id' => 8,
        'expires_in' => 300
    ]
]);

Example Response

{
  "status": "success",
  "data": {
    "uuid": "4dcc0220-45b8-4e96-bae1-cb645cc49965",
    "user_id": 7,
    "login_user_id": 8,
    "expires_at": "2026-08-06 11:05:00",
    "created_at": "2026-08-06 11:00:00",
    "updated_at": "2026-08-06 11:00:00",
    "deleted_at": null,
    "token": "eyJhbGciOiJSUzI1NiJ9.eyJsdGkiOiI0ZGNjMDIyMC00NWI4LTRlOTYtYmFlMS1jYjY0NWNjNDk5NjUiLCJzdWIiOjh9.signature"
  }
}

Admin: Create by Email

Create a UserLoginToken for one email address.

Definition

POST /api/administration/users/login-tokens/email

Request Keys

Key	Type	Default	Description
login_user_email*	string	-	Unique email of an active, non-internal User, following the shared Email Addresses rules.
expires_in*	integer	-	Lifetime in seconds, from 1 through 86400.

Keys with * are required.

Behavior

user_id is always taken from the authenticated user. The email is resolved to login_user_id; therefore the example request contains the value needed to produce login_user_id: 19 in the response.

Example Request

PHP

$client = new GuzzleHttp\Client(['base_uri' => 'https://{tenant}.intratool.de']);
$response = $client->request('POST', '/api/administration/users/login-tokens/email', [
    'headers' => ['Authorization' => "Bearer {accessToken}"],
    'json' => [
        'login_user_email' => '[e-mail]',
        'expires_in' => 900
    ]
]);

Example Response

{
  "status": "success",
  "data": {
    "uuid": "9f9771b3-c6fe-442e-81c8-af4d0bde93bc",
    "user_id": 7,
    "login_user_id": 19,
    "expires_at": "2026-08-06 11:30:00",
    "created_at": "2026-08-06 11:15:00",
    "updated_at": "2026-08-06 11:15:00",
    "deleted_at": null,
    "token": "eyJhbGciOiJSUzI1NiJ9.eyJsdGkiOiI5Zjk3NzFiMy1jNmZlLTQ0MmUtODFjOC1hZjRkMGJkZTkzYmMiLCJzdWIiOjE5fQ.signature"
  }
}

Admin: Delete

Delete an existing UserLoginToken.

Definition

DELETE /api/administration/users/login-tokens/{userLoginToken}

Route Parameters

Parameter	Type	Description
userLoginToken	UUID	UserLoginToken UUID.

Example Request

PHP

$client = new GuzzleHttp\Client(['base_uri' => 'https://{tenant}.intratool.de']);
$response = $client->request('DELETE', '/api/administration/users/login-tokens/4dcc0220-45b8-4e96-bae1-cb645cc49965', [
    'headers' => ['Authorization' => "Bearer {accessToken}"]
]);

Example Response

{
  "status": "success",
  "data": null
}