Personal Access Tokens

Personal Access Tokens are user-owned credentials for the Hamstik CLI, scripts, agents, and other automation. Create them from Account → Developer Settings.

When creating a token:

give it a recognizable name;
select only the scopes it needs;
choose all resources you can access or restrict it to Organizations and/or Projects;
choose an expiration from 1 to 365 days. The account UI defaults to 90 days.

The account scope picker includes organization:members:read, work_item:delete, and profile:read but does not preselect them for new tokens; the current defaults for existing scopes are preserved. Existing PAT rows remain valid with their stored capabilities. PAT scopes cannot be edited: create and verify a replacement token with the new scope, then revoke the old token.

project:write includes project:read, work_item:write includes work_item:read, work_item:delete includes work_item:write and work_item:read, comment:write includes comment:read, and comment:delete includes comment:read, and both attachment:write and attachment:delete include attachment:read. organization:members:read and profile:read imply nothing. No other scope is implied. A PAT never grants an Organization role or membership: effective access is the intersection of the token’s scopes, its resource restrictions, and the user’s current Hamstik authorization.

The complete token is shown exactly once after creation. Copy it immediately and store it in a secure credential store. Hamstik stores only a selector and a SHA-256 digest, so the secret cannot be recovered from the token list. Later lists show metadata, scopes, restrictions, expiration, revocation, and last-use time, but never the token or its hash.

Revoking a token takes effect on the next request. Removing the owning account revokes all of its tokens. A successful request updates last-used metadata at most about once every 15 minutes.

Example:

curl \
  -H "Authorization: Bearer $HAMSTIK_TOKEN" \
  https://hamstik.com/api/v1/me

Scope and resource matrix

Operation	Scope
List or read Organizations	`organization:read`
List active Organization members	`organization:members:read`
List or read Projects	`project:read`
Create Projects	`project:write`
Create Project labels, Sprints, and Project lifecycle mutations	`project:write`
List or read Work Items; discover transitions	`work_item:read`
Create or update Work Items; transition status	`work_item:write`
Delete, archive, or unarchive Work Items	`work_item:delete`
Read authenticated profiles, profile work, and profile activity	`profile:read`
List comments	`comment:read`
Create comments	`comment:write`
Delete your comments with no replies	`comment:delete`
List or download Work Item attachments	`attachment:read`
Upload Work Item attachments	`attachment:write`
Delete Work Item attachments	`attachment:delete`
Update Projects and archive/unarchive Projects	`project:write`
Bulk create, update, or transition Work Items	`work_item:write`
Create or delete Work Item links and assign/remove labels	`work_item:write`
Read Work Item and Project activity	`work_item:read`
Edit authored comments	`comment:write`

Mutation scopes imply their matching read scope. A restricted PAT can be granted specific Organizations or Projects. An Organization grant includes its current and future Projects; a Project grant includes only that Project and may expose its parent Organization as the minimum context needed to address it.

Every request still checks the user’s current membership and role. Removing a user’s membership takes effect immediately for existing PATs, and a suspended Organization cannot be accessed by presenting a PAT.

PAT scope grants are immutable. To obtain a newly introduced scope, create a replacement PAT with that scope, verify the replacement, and then revoke the old PAT.

profile:read authorizes only the authenticated profile resources and does not create an anonymous directory. organization:members:read authorizes the active member directory. A Project-restricted PAT may use that directory only when it has at least one granted Project in the Organization. Profile visibility, Work Item involvement, statistics, activity, and pagination are all narrowed by the same Organization/Project grant intersection before any response is serialized.