---
title: "List the company's programmatic API keys"
method: GET
path: "/users/api-keys"
tags: ["API Keys"]
---

# List the company's programmatic API keys

`GET /users/api-keys`

## Request

- Base URL: `https://api.atako.ai`
- URL: `https://api.atako.ai/users/api-keys`
- Auth: HTTP bearer

Company-admin only, signed-in session only: an API key gets `403 API_KEY_FORBIDDEN`. Every key created by a member of the caller's company, with its creator. A key stops authenticating as soon as its creator is no longer a company admin (keys are revoked on demotion or removal).

## Response `200`

- ApiKeyListed[]
  - `id` string, uuid, required
  - `name` string, required
  - `keyPrefix` string, required
  - `active` boolean, required
  - `scope` 'read' | 'write', required: `read`: GET only. `write`: everything except the operations marked `x-atako-api-key: forbidden`.
  - `expiresAt` string, date-time, nullable, required: Past this instant the key is refused (401 API_KEY_EXPIRED). Null = never.
  - `lastUsedAt` string, date-time, nullable
  - `createdAt` string, date-time, required

## Other responses

- `401`: Missing, malformed, or invalid bearer token / API key, or revoked session (SESSION_REVOKED).
- `403`: The caller does not have the required role/permission.

---

[API](https://skmtc.dev/atako/apis/atako-api.md) · [All operations](https://skmtc.dev/atako/apis/atako-api/llms.txt) · [OpenAPI document](https://skmtc.dev/atako/apis/atako-api/revisions/aa555c56fbd7?raw)