# List API Keys

- **Method:** `GET`
- **Path:** `/api/v1/api-keys`
- **Operation ID:** `list_api_keys`
- **Tags:** identity

This tenant's live keys, oldest first. Metadata only - no secret and no hash comes back out.

`last_used_at` is the field this list exists for: it answers "is anything still using this" before a
revocation, and it is stamped at most once every few minutes per key, not on every request.

## Effective servers

- `https://api.saram.sh`

  Saram

## Authentication

- **HTTPBearer**: HTTP bearer

  a Saram API key (`sk_saram_<env>_...`) or a person's AuthKit access token, as `Authorization: Bearer <credential>`. Both are told apart by shape and produce the same principal.

## Responses

### 200 Successful Response

**Content type:** `application/json`

schema: `ApiKeyList`, no additional properties

The tenant's API keys, as metadata: never a key's secret, which is shown once, when it is minted.

- **`api_keys` (required)**: `array`

  This tenant's live keys, oldest first. A revoked one is not listed.

  **Items:**

  schema: `ApiKeySummary`, no additional properties

  One of this tenant's machine keys, as the list and the revocation answer it. The secret is not here.
  - **`created_at` (required)**: `string`, format: `date-time`
  - **`created_by` (required)**: `string`

    usr\_... for a person who minted it from the dashboard, operator for the CLI.
  - **`id` (required)**: `string`
  - **`name` (required)**: `string`
  - **`scopes` (required)**: `array of string`
  - **`expires_at`**: `string | null`, format: `date-time`
  - **`last_used_at`**: `string | null`, format: `date-time`

    When this key last got through the gate, to a few minutes: it answers whether anything is still using the key before you revoke it, which does not need the last second.
  - **`revoked_at`**: `string | null`, format: `date-time`

    Set on the record DELETE answers with. The row stays; the key stops working.

**Example:**

```json
{
  "api_keys": [
    {
      "id": "",
      "name": "",
      "scopes": [
        ""
      ],
      "created_by": "",
      "created_at": "",
      "last_used_at": "",
      "expires_at": "",
      "revoked_at": ""
    }
  ]
}
```

### 403 this credential may not mint keys: an API key without the keys:admin scope, or a person whose role in this tenant is not owner or admin

## Schemas

- `ApiKeyList` — shown above.
- `ApiKeySummary` — shown above.