---
title: "List API keys for the authenticated tenant (no plaintext or hash)."
method: GET
path: "/v1/api-keys"
tags: ["api-keys"]
---

# List API keys for the authenticated tenant (no plaintext or hash).

`GET /v1/api-keys`

## Request

- Base URL: `https://api.andish.ru` (the document declares no server; this is the origin it was published from)
- URL: `https://api.andish.ru/v1/api-keys`
- Auth: none declared

Return all API keys (active and revoked) for the authenticated tenant.

key_hash and plaintext are NEVER present in the response (AC #4, STRIDE I1/I3).
RLS on the tenant session automatically scopes results to the current tenant;
the explicit WHERE clause below is defence-in-depth against IDOR (AC #8).

Also reports active_key_count / active_key_limit (FREE-TIER-TIGHTEN AC #5)
so the Dashboard can render "used N of M" without hardcoding tier numbers.
A tenant row that cannot be resolved (edge case: deleted mid-request)
falls back to the default (most restrictive) limit rather than failing
the whole list request.

## Response `200`

Successful Response

- ApiKeyListResponse: Envelope for GET /v1/api-keys. active_key_count / active_key_limit (FREE-TIER-TIGHTEN AC #5): the Dashboard renders "used N of M" from these fields — it must never hardcode the tier limit itself. active_key_limit is None when the tier has no upper bound (business/enterprise).
  - `api_keys` ApiKeyResponse[], required
    - `id` string, uuid, required
    - `prefix` string, required
    - `scopes` string[], required
    - `created_at` string, date-time, required
    - `last_used_at` string, date-time, nullable
    - `revoked_at` string, date-time, nullable
    - `name` string, nullable
    - `body_hint` string, nullable
  - `active_key_count` integer, required: Number of currently active (non-revoked) API keys for this tenant.
  - `active_key_limit` integer, nullable, required: Tier's active-key limit. None means unlimited (business/enterprise). The Dashboard must render this value, not a hardcoded number.

## Other responses

- `401`: Not authenticated or API-key auth used (JWT required)

---

[API](https://skmtc.dev/andish/apis/mnemo-api.md) · [All operations](https://skmtc.dev/andish/apis/mnemo-api/llms.txt) · [OpenAPI document](https://skmtc.dev/andish/apis/mnemo-api/revisions/d5449f23414c?raw)