As a Jenkins administrator, how do I get a user's API token without logging in as them?
There is a Jenkins System Property, jenkins.security.ApiTokenProperty.showTokenToAdmins . You need access to the master/OC process startup to change it.
Documented at the bottom of https://wiki.jenkins-ci.org/display/JENKINS/Features+controlled+by+system+properties
(We are going to do our best to leave this at false.)