---
title: "Get a key's audit trail"
method: GET
path: "/api_keys/{id}/history"
tags: ["API Keys"]
---

# Get a key's audit trail

`GET /api_keys/{id}/history`

## Request

- Base URL: `https://alttext.ai/api/v1`
- URL: `https://alttext.ai/api/v1/api_keys/{id}/history`
- Auth: API key in header `X-API-Key`

Lists what happened to the key, newest first: creation, edits, rotations, revocation and token reveals,
each with who did it and the values that changed. A revoked key's history stays readable.

## Path parameters

- `id` integer, required

## Query parameters

- `after` string
- `limit` integer

## Response `200`

A page of events.

- ApiKeyHistory
  - `events` ApiKeyEvent[]: Newest first.
    - `id` integer
    - `action` 'created' | 'updated' | 'rotated' | 'revoked' | 'revocation_reconciled' | 'revealed' | 'kind_switched': `revealed` is recorded each time a token is read with `reveal=true`. `revocation_reconciled` records a system repair of missing legacy revocation history without claiming a historical actor.
    - `actor` object: Who did it. For an API request this is the key that made the call.
      - `type` 'user' | 'api_key' | 'mcp_connection' | 'system'
      - `name` string, nullable
    - `before` object: The values that changed, before the event. Only `name`, `limit`, `kind` and `status` are recorded.
    - `after` object: The same values after the event.
    - `created_at` string, date-time
  - `next_cursor` string, nullable
  - `has_more` boolean

## Other responses

- `403`: The request was refused. `error_code` is one of: - `invalid_api_key`: the `X-API-Key` header is missing or doesn't match a key. - `api_key_revoked`: the key was revoked. Create a new key. - `full_access_required`: managing keys needs a full-access key. Create one in the dashboard under Account > API Keys. - `insufficient_scope`: an assistant connection lacks the Manage API keys permission (`required_scope` is `mcp:keys`), or read-only access when changing keys or revealing a token (`mcp:write`). Reconnect with the permission. - `credential_no_longer_authorized`: the account closed or the calling credential lost authority before the mutation acquired its lock. Reconnect or use a current full-access key. - `out_of_scope`: this key can't be used for this request.
- `404`: No manageable key with that ID on this account. `error_code` is `not_found`. Full-access keys, MCP connection keys and the Webflow Designer key are never found here.
- `422`: `after` wasn't issued by this API. `error_code` is `invalid_params`.
- `429`: Too many key requests for this account. The limit is 120 reads and 30 changes per minute, counted per account across all the API Keys endpoints. Wait `Retry-After` seconds. `error_code` is `rate_limited`.

---

[API](https://skmtc.dev/alttext/apis/alttext-ai-api.md) · [All operations](https://skmtc.dev/alttext/apis/alttext-ai-api/llms.txt) · [OpenAPI document](https://skmtc.dev/alttext/apis/alttext-ai-api/revisions/6eb62e8e450c?raw)