---
title: "List API keys"
method: GET
path: "/keys"
tags: ["Key Management"]
---

# List API keys

`GET /keys`

## Request

- Base URL: `https://app.arkova.ai/api/v1`
- URL: `https://app.arkova.ai/api/v1/keys`
- Auth: HTTP bearer

By default, organization admins list every key in their organization and members list only keys assigned to them. Add context=personal to list the JWT owner's personal keys even after joining an organization; listing and revocation remain available if the paid plan or identity verification lapses.

## Query parameters

- `context` 'personal'

## Headers

- `X-Org-Id` string, uuid

## Response `200`

List of API keys (masked)

- object
  - `can_manage` boolean: True for an organization admin or the owner in explicit personal context. False for a member viewing assigned organization keys.
  - `keys` ApiKeyMasked[]
    - `id` string, uuid
    - `key_prefix` string
    - `name` string
    - `scopes` string[]
    - `is_active` boolean
    - `last_used_at` string, date-time, nullable
    - `created_at` string, date-time
    - `expires_at` string, date-time, nullable
    - `status` 'active' | 'expiring_soon' | 'expired' | 'revoked': Server-derived usability. Prefer this over is_active/expires_at: is_active is a stored flag that stays true on an expired key, while authentication rejects it. expiring_soon means live and expiring within 14 days.
    - `days_until_expiry` integer, nullable: Whole days until expiry — 0 on the final day, negative once past, null when the key does not expire. Deliberately NOT named expires_in_days: that is the REQUEST field on POST/PATCH and means a duration to set, not a countdown to read.
    - `principal_version` integer, nullable: Version 1 binds a human actor immutably; version 0 retains legacy issuer identity.
    - `principal_kind` 'legacy' | 'human', nullable
    - `actor_user_id` string, uuid, nullable: Immutable acting member for version 1 keys.
    - `issuer_user_id` string, uuid, nullable: Administrator who issued the key; audit provenance, not the member acting identity.
    - `assigned_user_id` string, uuid, nullable: The organization member this org-owned key is assigned to. Null when unassigned.
    - `assigned_user` object, nullable: Display fields of the assignee (organization-internal). Null when unassigned.
      - `id` string, uuid
      - `full_name` string, nullable
      - `email` string, nullable
  - `personal_eligibility` 'eligible' | 'paid_plan_required' | 'identity_verification_required' | 'unavailable': Returned in personal context to explain whether a new personal key may be created; does not restrict listing or revocation.

## Other responses

- `401`: Authentication required

---

[API](https://skmtc.dev/arkova/apis/arkova-verification-api.md) · [All operations](https://skmtc.dev/arkova/apis/arkova-verification-api/llms.txt) · [OpenAPI document](https://skmtc.dev/arkova/apis/arkova-verification-api/revisions/a14858d1efd4?raw)