This task's scope includes adding BDD tests for the workflows of the API's /apiTokens endpoint.

That includes:

• POST /apiTokens creates a new token and returns 201 and its details or 400 if the request was not correctly formed
• GET /apiTokens returns all existing tokens
• GET /apiTokens/:id returns 200 and details for token id or 404 if token id doesn't exist
• Access is restricted to authentication with admin token. For all three calls above:
  • Admin can access
  • Non-authenticated user gets 401
  • Regular user gets 403