---
title: "List API Keys"
method: GET
path: "/api/v1/api-keys"
tags: ["Basics"]
---

# List API Keys

`GET /api/v1/api-keys`

## Request

- Base URL: `https://api.athenahq.ai`
- URL: `https://api.athenahq.ai/api/v1/api-keys`
- Auth: API key in header `x-api-key`

Lists API key metadata for the authenticated key's organization, including each key's creator (ID, current name and email), creation date, scope and revocation status. Requires a global API key; website-scoped keys receive 403. No organization ID is accepted. Secrets and hashes are never returned. Revoked keys are included so you can detect a key created and revoked between polls. Results are ordered by creation date ascending, then ID ascending.

For new-key alerts, first record a baseline of key IDs. On each poll, pin `until` to now minus one minute, overlap `since` with the previous successful window, and keep both bounds fixed while incrementing `page_num` until `pagination.has_more` is false. Both time bounds are inclusive. Deduplicate alerts by key ID and advance your saved window only after all pages succeed. Filter `is_revoked` locally if you need active keys only.

This is a current inventory, not a durable audit log or webhook: deleting a creator's account removes their keys, and concurrent deletions can shift pages. Overlapping windows reduce polling gaps but cannot guarantee detection of every creation. The MCP tool `list_api_keys` exposes the same fields and filters to global API keys and organization-admin OAuth connections, subject to MCP permissions.

## Query parameters

- `since` string, date-time
- `until` string, date-time
- `page_num` integer
- `page_size` integer

## Response `200`

API key metadata, including revoked keys.

- object
  - `api_keys` object[], required
    - `id` string, uuid, required
    - `name` string, required
    - `key_prefix` string, required: Non-secret identifying prefix. Secrets and hashes are never returned.
    - `created_at` string, date-time, required
    - `created_by` object, required
      - `id` string, uuid, required
      - `name` string, nullable, required
      - `email` string, required
    - `is_global` boolean, required
    - `website_ids` string[], required: Allowed website IDs for a scoped key; empty for a global key.
    - `is_revoked` boolean, required: Whether the key has been revoked.
  - `pagination` object, required
    - `page_num` integer, required
    - `page_size` integer, required
    - `has_more` boolean, required

## Other responses

- `400`: Invalid query parameters or since is after until.
- `401`: Missing or invalid API key.
- `403`: A global API key is required.

## Changes

- **2026-11-03** `2d1d86d5e067`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/athenahq/apis/athenahq-api/changes/api/v1/api-keys/get.md)

---

[API](https://skmtc.dev/athenahq/apis/athenahq-api.md) - [All operations](https://skmtc.dev/athenahq/apis/athenahq-api/llms.txt) - [OpenAPI document](https://skmtc.dev/athenahq/apis/athenahq-api/revisions/6cf9ca58edf6?raw)