CI/CD job token scope API | GitLab Docs Skip to main content Go to GitLab Docs homepage What's new? What's new? Get free trial Toggle menu * Use GitLab * GitLab Duo * GitLab Orbit * Extend * Install * Administer * Subscribe * Contribute * Solutions Getting started Tutorials Integrations Webhooks REST API Resources .gitignore (templates) .gitlab-ci.yml (templates) Access requests Agent for Kubernetes AI Catalog admin Alert management Application appearance Application settings Application statistics Applications Attestations Audit events Avatar Branches Broadcast messages Cluster discovery (certificate-based) (deprecated) Code Suggestions Commits Compliance and policy settings Container registry Container virtual registry Custom attributes Database migrations Data management Dependencies Dependency firewall Dependency list export Deploy keys Deploy tokens Deployments Discussions Dockerfile (templates) DORA4 metrics Emoji reactions Environments Epics (deprecated) Error tracking Events Experiments External status checks Feature flags Feature flag user lists Flows Freeze periods Geo nodes (deprecated) Geo sites GitLab Duo Chat completions GitLab Pages GLQL Google Cloud integration Groups Import Instance CI/CD variables Invitations Issues Issues (epic) (deprecated) Issues statistics Jobs Job artifacts Job token scopes Keys License Licenses (templates) Linked epics (deprecated) Links (issue) Links (epic) (deprecated) Lint .gitlab-ci.yml Markdown Maven virtual registry Member roles Merge request approvals Merge request approval settings Merge request context commits Merge requests Merge trains Metadata Model registry Namespaces Notes (comments) Notification settings Orbit Organizations Package registry Pages domains Personal access tokens Pipeline schedules Pipeline trigger tokens Pipelines Plan limits Projects Repositories Repository files Repository submodules Resource group Resource iteration events Resource label events Resource milestone events Resource state events Resource weight events Runners Runner controllers Runner controller tokens Search Search migrations Secrets Manager API Secure files Service accounts Service Ping Sidekiq metrics Sidekiq queues Snippet repository storage moves Snippets Suggestions System hooks Tags To-Do List Token information Topics Users User applications Virtual registries cleanup policies Vulnerabilities Vulnerability archive export Vulnerability export Vulnerability findings Web commits Authentication Third-party clients Deprecations and removals OpenAPI Automate storage management Troubleshooting GraphQL API OAuth 2.0 identity provider API GitLab MCP server GitLab Duo CLI (duo) GitLab CLI (glab) Editor and IDE extensions * GitLab Docs / * Extend / * REST API / * Resources / * Job token scopes Help us learn about your current experience with the documentation. Take the survey . CI/CD job token scope API * Tier : Free, Premium, Ultimate * Offering : GitLab.com, GitLab Self-Managed, GitLab Dedicated Use this API to interact with CI/CD job token scopes. All requests to the CI/CD job token scope API endpoint must be authenticated . The authenticated user must have the Maintainer or Owner role for the project. Retrieve the CI/CD job token access settings for a project Retrieves the CI/CD job token access settings (job token scope) of a specified project. GET /projects/:id/job_token_scope Supported attributes: Attribute Type Required Description id integer or string Yes ID or URL-encoded path of the project . If successful, returns 200 and the following response attributes: Attribute Type Description inbound_enabled boolean Indicates if the Authorized groups and projects setting is enabled for the allowlist. If disabled, then all projects have access . This value shows whether the allowlist is currently active, which can be true due to the Enforce job token allowlist instance setting. outbound_enabled boolean Indicates if the CI/CD job token generated in this project has access to other projects. Deprecated and planned for removal in GitLab 18.0 . Example request: curl --request GET \ --header "PRIVATE-TOKEN: <your_access_token>" \ --url "https://gitlab.example.com/api/v4/projects/1/job_token_scope" Example response: { "inbound_enabled" : true , "outbound_enabled" : false } Update the CI/CD job token access settings for a project History * Renamed from Allow access to this project with a CI_JOB_TOKEN to Limit access to this project in GitLab 16.3. * Renamed from Limit access to this project to Authorized groups and projects in GitLab 17.2. Updates the Authorized groups and projects setting (job token scope) of a specified project. PATCH /projects/:id/job_token_scope Supported attributes: Attribute Type Required Description id integer or string Yes ID or URL-encoded path of the project . enabled boolean Yes Restricts job token access to allowlisted projects only. Set to false to allow access from all projects. This parameter can be overridden by the Enforce job token allowlist instance setting. If successful, returns 204 and no response body. If the Enforce job token allowlist instance setting is enabled and you attempt to set enabled to false , returns 400 with an error message. Example request: curl --request PATCH \ --url "https://gitlab.example.com/api/v4/projects/1/job_token_scope" \ --header 'PRIVATE-TOKEN: <your_access_token>' \ --header 'Content-Type: application/json' \ --data '{ "enabled": false }' List all projects in a CI/CD job token allowlist Lists all projects in the CI/CD job token allowlist of a specified project. GET /projects/:id/job_token_scope/allowlist Supported attributes: Attribute Type Required Description id integer or string Yes ID or URL-encoded path of the project . This endpoint supports offset-based pagination . If successful, returns 200 and a list of projects with limited fields for each project. Example request: curl --request GET \ --header "PRIVATE-TOKEN: <your_access_token>" \ --url "https://gitlab.example.com/api/v4/projects/1/job_token_scope/allowlist" Example response: [ { "id" : 4 , "description" : null , "name" : "Diaspora Client" , "name_with_namespace" : "Diaspora / Diaspora Client" , "path" : "diaspora-client" , "path_with_namespace" : "diaspora/diaspora-client" , "created_at" : "2013-09-30T13:46:02Z" , "default_branch" : "main" , "tag_list" : [ "example" , "disapora client" ], "topics" : [ "example" , "disapora client" ], "ssh_url_to_repo" : "[email protected]:diaspora/diaspora-client.git" , "http_url_to_repo" : "https://gitlab.example.com/diaspora/diaspora-client.git" , "web_url" : "https://gitlab.example.com/diaspora/diaspora-client" , "avatar_url" : "https://gitlab.example.com/uploads/project/avatar/4/uploads/avatar.png" , "star_count" : 0 , "last_activity_at" : "2013-09-30T13:46:02Z" , "namespace" : { "id" : 2 , "name" : "Diaspora" , "path" : "diaspora" , "kind" : "group" , "full_path" : "diaspora" , "parent_id" : null , "avatar_url" : null , "web_url" : "https://gitlab.example.com/diaspora" } }, { ... } Add a project to a CI/CD job token allowlist Adds a project to the CI/CD job token allowlist of a specified project. POST /projects/:id/job_token_scope/allowlist Supported attributes: Attribute Type Required Description id integer or string Yes ID or URL-encoded path of the project . target_project_id integer Yes The ID of the project added to the CI/CD job token inbound allowlist. If successful, returns 201 and the following response attributes: Attribute Type Description source_project_id integer ID of the project containing the CI/CD job token inbound allowlist to update. target_project_id integer ID of the project that is added to the source project s inbound allowlist. Example request: curl --request POST \ --url "https://gitlab.example.com/api/v4/projects/1/job_token_scope/allowlist" \ --header 'PRIVATE-TOKEN: <your_access_token>' \ --header 'Content-Type: application/json' \ --data '{ "target_project_id": 2 }' Example response: { "source_project_id" : 1 , "target_project_id" : 2 } Delete a project from a CI/CD job token allowlist Deletes a project from the CI/CD job token allowlist of a specified project. DELETE /projects/:id/job_token_scope/allowlist/:target_project_id Supported attributes: Attribute Type Required Description id integer or string Yes ID or URL-encoded path of the project . target_project_id integer Yes The ID of the project that is removed from the CI/CD job token inbound allowlist. If successful, returns 204 and no response body. Example request: curl --request DELETE \ --url "https://gitlab.example.com/api/v4/projects/1/job_token_scope/allowlist/2" \ --header 'PRIVATE-TOKEN: <your_access_token>' \ --header 'Content-Type: application/json' List all groups in a CI/CD job token allowlist Lists all groups in the CI/CD job token allowlist of a specified project. GET /projects/:id/job_token_scope/groups_allowlist Supported attributes: Attribute Type Required Description id integer or string Yes ID or URL-encoded path of the project . This endpoint supports offset-based pagination . If successful, returns 200 and a list of groups with limited fields for each project. Example request: curl --request GET \ --header "PRIVATE-TOKEN: <your_access_token>" \ --url "https://gitlab.example.com/api/v4/projects/1/job_token_scope/groups_allowlist" Example response: [ { "id" : 4 , "web_url" : "https://gitlab.example.com/groups/diaspora/diaspora-group" , "name" : "namegroup" }, { ... } ] Add a group to a CI/CD job token allowlist Adds a group to the CI/CD job token allowlist of a specified project. POST /projects/:id/job_token_scope/groups_allowlist Supported attributes: Attribute Type Required Description id integer or string Yes ID or URL-encoded path of the project . target_group_id integer Yes The ID of the group added to the CI/CD job token groups allowlist. If successful, returns 201 and the following response attributes: Attribute Type Description source_project_id integer ID of the project containing the CI/CD job token inbound allowlist to update. target_group_id integer ID of the group that is added to the source project s groups allowlist. Example request: curl --request POST \ --url "https://gitlab.example.com/api/v4/projects/1/job_token_scope/groups_allowlist" \ --header 'PRIVATE-TOKEN: <your_access_token>' \ --header 'Content-Type: application/json' \ --data '{ "target_group_id": 2 }' Example response: { "source_project_id" : 1 , "target_group_id" : 2 } Delete a group from a CI/CD job token allowlist Deletes a group from the CI/CD job token allowlist of a specified project. DELETE /projects/:id/job_token_scope/groups_allowlist/:target_group_id Supported attributes: Attribute Type Required Description id integer or string Yes ID or URL-encoded path of the project . target_group_id integer Yes The ID of the group that is removed from the CI/CD job token groups allowlist. If successful, returns 204 and no response body. Example request: curl --request DELETE \ --url "https://gitlab.example.com/api/v4/projects/1/job_token_scope/groups_allowlist/2" \ --header 'PRIVATE-TOKEN: <your_access_token>' \ --header 'Content-Type: application/json' * Retrieve the CI/CD job token access settings for a project * Update the CI/CD job token access settings for a project * List all projects in a CI/CD job token allowlist * Add a project to a CI/CD job token allowlist * Delete a project from a CI/CD job token allowlist * List all groups in a CI/CD job token allowlist * Add a group to a CI/CD job token allowlist * Delete a group from a CI/CD job token allowlist * Facebook * LinkedIn * Twitter * YouTube Company * About GitLab * View pricing * Try GitLab for free Feedback * View page source * Edit in Web IDE * Contribute to GitLab * Suggest updates Help & Community * Get certified * Get support * Post on the GitLab forum Resources * Terms * Privacy statement * Use of generative AI * Acceptable use of user licenses *