---
title: "List the caller's wrapped shares for a key"
method: GET
path: "/v1/keys/{key_id}/client-share"
tags: ["Key Custody"]
---

# List the caller's wrapped shares for a key

`GET /v1/keys/{key_id}/client-share`

## Request

- Base URL: `https://api.1claw.co`
- URL: `https://api.1claw.co/v1/keys/{key_id}/client-share`
- Auth: HTTP bearer

Returns every wrap on file for this key, unopened, to the user who
stored them. `custody` tells you whether the key is `server` (1claw
holds the whole private key) or `client_tss` (threshold; neither party
can sign alone). Funding a `client_tss` wallet needs at least two wraps.

## Response `200`

Wraps on file

- ClientShareListResponse
  - `key_id` string, uuid
  - `key_kind` 'agent_signing_key' | 'treasury_wallet'
  - `generation` integer: The key's live share generation; only its wraps sign.
  - `pending_generation` integer, nullable: A refresh waiting to be committed or aborted.
  - `custody` 'server' | 'client_tss': `server` — 1claw holds the whole private key and can sign alone. `client_tss` — 2-party threshold key; the customer's share is required.
  - `shares` ClientShareResponse[]
    - `id` string, uuid
    - `key_id` string, uuid
    - `key_kind` 'agent_signing_key' | 'treasury_wallet'
    - `wrap_kind` 'passkey_prf' | 'recovery_code' | 'sidecar'
    - `credential_id` string, uuid, nullable
    - `holder_id` string, uuid, nullable
    - `wrapped_share` string: Base64, exactly as stored.
    - `salt` string: Base64.
    - `wrap_version` 1 | 2
    - `generation` integer
    - `created_at` string, date-time
    - `updated_at` string, date-time

## Other responses

- `401`: Authentication required or invalid
- `403`: Insufficient permissions
- `404`: Resource not found

---

[API](https://skmtc.dev/1claw/apis/1claw-api.md) · [All operations](https://skmtc.dev/1claw/apis/1claw-api/llms.txt) · [OpenAPI document](https://skmtc.dev/1claw/apis/1claw-api/revisions/5fa0918f3b41?raw)