Skip to main content

Organization control over PATs

Organizations now have more control over their users' Personal Access Tokens (PATs): requests made with the PAT of a deactivated user, or of an organization that has disabled PATs, are rejected.

The API now checks two conditions on every request authenticated with a PAT:

  • Active user: if the user who owns the PAT has been deactivated in Gorila, the request returns 401 with the message inactive user.
  • PATs enabled in the organization: organizations can disable the use of PATs by their users. While PATs are disabled, new PATs cannot be created, and requests with the organization's existing PATs return 401:
{
  "code": 401,
  "message": "Personal Access Tokens are disabled for this organization"
}

The organization's API keys are not affected by these checks.