diff --git a/spec/definitions.yaml b/spec/definitions.yaml
index 862ef00..8facd48 100644
--- a/spec/definitions.yaml
+++ b/spec/definitions.yaml
@@ -1040,9 +1040,10 @@ PatchOperation:
       example: replace
     path:
       type: string
-      example: "/on"
+      example: "/name"
     value:
       type: object
+      example: "My resource name"
   required:
     - op
     - path
@@ -1333,3 +1334,67 @@ FlagListItem:
       $ref: "#/definitions/Links"
     _site:
       $ref: "#/definitions/Site"
+Tokens:
+  type: object
+  properties:
+    _links:
+      $ref: "#/definitions/Links"
+    items:
+      type: array
+      items:
+        $ref: "#/definitions/Token"
+Token:
+  type: object
+  properties:
+    _links:
+      $ref: "#/definitions/Links"
+    _id:
+      $ref: "#/definitions/Id"
+    ownerId:
+      $ref: "#/definitions/Id"
+    memberId:
+      $ref: "#/definitions/Id"
+    _member:
+      $ref: "#/definitions/Member"
+    creationDate:
+      type: integer
+      format: int64
+      description: A unix epoch time in milliseconds specifying the creation time of this access token.
+      example: 1443652232590
+    lastModified:
+      type: integer
+      format: int64
+      example: 1469326565348
+      description: A unix epoch time in milliseconds specifying the last time this access token was modified.
+    lastUsed:
+      type: integer
+      format: int64
+      example: 1469326565348
+      description: A unix epoch time in milliseconds specifying the last time this access token was used to authorize access to the LaunchDarkly REST API.
+    token:
+      type: string
+      example: "3243"
+      description: The last 4 digits of the unique secret key for this access token. If creating or resetting the token, this will be the full token secret.
+    name:
+      type: string
+      description: A human-friendly name for the access token
+      example: "My access token"
+    role:
+      type: string
+      description: The name of a built-in role for the token
+      example: "writer"
+    customRoleIds:
+      type: array
+      items:
+        type: string
+      description: A list of custom role IDs to use as access limits for the access token
+    inlineRole:
+      type: array
+      items:
+        $ref: "#/definitions/Statement"
+    serviceToken:
+      type: boolean
+      description: "Whether the token will be a service token https://docs.launchdarkly.com/home/account-security/api-access-tokens#service-tokens"
+    defaultApiVersion:
+      type: integer
+      description: The default API version for this token
diff --git a/spec/parameters.yaml b/spec/parameters.yaml
index fd6fef5..b5a3546 100644
--- a/spec/parameters.yaml
+++ b/spec/parameters.yaml
@@ -240,7 +240,7 @@ ArchivedQuery:
   name: archived
   in: query
   required: false
-  description: When set to 1, archived flags will be included in the list of flags returned.  By default, archived flags are not included in the list of flags.
+  description: When set to 1, only archived flags will be included in the list of flags returned.  By default, archived flags are not included in the list of flags.
   type: boolean
 LimitQuery:
   name: limit
@@ -519,3 +519,54 @@ EvaluationFlagKey:
   description: The key of the flag we want metrics for.
   type: string
 #  example: ''
+TokensPostRequest:
+  name: tokenBody
+  in: body
+  required: true
+  description: Create a new access token.
+  schema:
+    type: object
+    properties:
+      name:
+        type: string
+        description: A human-friendly name for the access token
+        example: "My access token"
+      role:
+        type: string
+        description: The name of a built-in role for the token
+        example: "writer"
+      customRoleIds:
+        type: array
+        items:
+          type: string
+          example: []
+        description: A list of custom role IDs to use as access limits for the access token
+      inlineRole:
+        type: array
+        items:
+          $ref: "#/definitions/Statement"
+      serviceToken:
+        type: boolean
+        description: "Whether the token will be a service token https://docs.launchdarkly.com/home/account-security/api-access-tokens#service-tokens"
+      defaultApiVersion:
+        type: integer
+        description: The default API version for this token
+TokenId:
+  name: tokenId
+  in: path
+  required: true
+  description: The access token ID.
+  type: string
+TokenShowAllQuery:
+  name: showAll
+  in: query
+  required: false
+  description: 'If set to true, and the authentication access token has the "Admin" role, personal access tokens for all members will be retrieved.'
+  type: boolean
+TokenExpiry:
+  name: expiry
+  in: query
+  required: false
+  type: integer
+  format: int64
+  description: An expiration time for the old token key, expressed as a Unix epoch time in milliseconds. By default, the token will expire immediately.
diff --git a/spec/paths.yaml b/spec/paths.yaml
index 156bfd6..5eaa914 100644
--- a/spec/paths.yaml
+++ b/spec/paths.yaml
@@ -82,5 +82,11 @@
   $ref: ./paths/cmetrics.yaml#/Event
 /usage/evaluations/{envId}/{flagKey}:
   $ref: ./paths/cmetrics.yaml#/Evaluations
+/tokens:
+  $ref: ./paths/tokens.yaml#/Tokens
+/tokens/{tokenId}:
+  $ref: ./paths/tokens.yaml#/Token
+/tokens/{tokenId}/reset:
+  $ref: ./paths/tokens.yaml#/Reset
 /:
   $ref: ./paths/root.yaml#/Root
diff --git a/spec/paths/tokens.yaml b/spec/paths/tokens.yaml
new file mode 100644
index 0000000..bdf3513
--- /dev/null
+++ b/spec/paths/tokens.yaml
@@ -0,0 +1,97 @@
+Tokens:
+  get:
+    summary: Returns a list of tokens in the account.
+    operationId: getTokens
+    parameters:
+      - $ref: "#/parameters/TokenShowAllQuery"
+    responses:
+      "200":
+        description: Tokens response.
+        schema:
+          $ref: "#/definitions/Tokens"
+      "401":
+        $ref: "#/responses/Standard401"
+    tags:
+      - Access tokens
+  post:
+    summary: Create a new token.
+    operationId: postToken
+    parameters:
+      - $ref: "#/parameters/TokensPostRequest"
+    responses:
+      "201":
+        description: Token response.
+        schema:
+          $ref: "#/definitions/Token"
+      "400":
+        $ref: "#/responses/Standard400"
+      "401":
+        $ref: "#/responses/Standard401"
+      "409":
+        $ref: "#/responses/Standard409"
+    tags:
+      - Access tokens
+Token:
+  get:
+    summary: Get a single access token by ID.
+    operationId: getToken
+    parameters:
+      - $ref: "#/parameters/TokenId"
+    responses:
+      "200":
+        $ref: "#/responses/Token2xx"
+      "400":
+        $ref: "#/responses/Standard400"
+      "401":
+        $ref: "#/responses/Standard401"
+    tags:
+      - Access tokens
+  patch:
+    summary: Modify an access tokenby ID.
+    operationId: patchToken
+    parameters:
+      - $ref: "#/parameters/TokenId"
+      - $ref: "#/parameters/PatchRequest"
+    responses:
+      "200":
+        $ref: "#/responses/Token2xx"
+      "400":
+        $ref: "#/responses/Standard400"
+      "401":
+        $ref: "#/responses/Standard401"
+      "404":
+        $ref: "#/responses/Standard404"
+      "409":
+        $ref: "#/responses/Standard409"
+    tags:
+      - Access tokens
+  delete:
+    summary: Delete an access token by ID.
+    operationId: deleteToken
+    parameters:
+      - $ref: "#/parameters/TokenId"
+    responses:
+      "204":
+        $ref: "#/responses/Standard204"
+      "401":
+        $ref: "#/responses/Standard401"
+      "404":
+        $ref: "#/responses/Standard404"
+    tags:
+      - Access tokens
+Reset:
+  post:
+    summary: Reset an access token's secret key with an optional expiry time for the old key.
+    operationId: resetToken
+    parameters:
+      - $ref: "#/parameters/TokenId"
+      - $ref: "#/parameters/TokenExpiry"
+    responses:
+      "200":
+        $ref: "#/responses/Token2xx"
+      "400":
+        $ref: "#/responses/Standard400"
+      "401":
+        $ref: "#/responses/Standard401"
+    tags:
+      - Access tokens
diff --git a/spec/responses.yaml b/spec/responses.yaml
index 52afd12..37b9065 100644
--- a/spec/responses.yaml
+++ b/spec/responses.yaml
@@ -54,3 +54,7 @@ Destination2xx:
   description: Destination response.
   schema:
     $ref: "#/definitions/Destination"
+Token2xx:
+  description: Token response.
+  schema:
+    $ref: "#/definitions/Token"