Skip to main content
GET
List all API keys for an organization
Legacy endpoint - deprecated. Unversioned endpoints are scheduled for removal on July 31, 2026. A public v1 replacement is not currently listed in the v1 reference. This endpoint remains available for existing integrations until then.
Returns every API key registered on your workspace, paginated. Each entry includes the key’s stable id, its display name, the creation timestamp, and the last_used_at timestamp updated each time a request is authenticated with the key. Secret values are never returned by any endpoint after key creation, if you have lost a secret, revoke the key with Revoke API Key and issue a new one with Create API Key.

When to use this

  • Security audits: enumerate every key, check last_used_at to find dormant keys that should be revoked.
  • Rotation playbooks: confirm a newly created key is present before deploying it to consumer services.
  • Operational dashboards: render an API key management page with the canonical list.
  • Compliance reviews: produce a report of which keys exist in each workspace.
For details on how to rotate keys safely, see Key rotation.

Query parameters

Errors

  • 403 Forbidden is returned when the caller’s API key cannot manage other keys.

Authorizations

Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Headers

x-organization-id
string
required

RSA encrypted organization ID (base64 format)

Example:

"BASE64_ENCRYPTED_ORG_ID_HERE"

Response

200 - application/json

List of API keys