---
title: "List API keys"
method: GET
path: "/apiKeys"
tags: ["API keys"]
---

# List API keys

`GET /apiKeys`

## Request

- Base URL: `https://api.cactal.ai/v1`
- URL: `https://api.cactal.ai/v1/apiKeys`
- Auth: HTTP bearer

Returns API keys newest first with keyset pagination and their full access configuration. Pass exactly one of `organizationId` (the full organization inventory) or `websiteId` (only keys whose access kind is `websites` with a direct grant on that website — organization-wide keys can also act on the website but appear only in the organization inventory). Revoked keys are excluded by default; pass `revoked=only` to list them instead. Page size defaults to 20 (maximum 100). Secrets are never returned — only metadata.

## Query parameters

- `organizationId` string: Organization whose full API key inventory to list. Provide either this or `websiteId`.
- `websiteId` string: List only API keys with a direct grant on this website (access kind `websites`). Organization-wide keys can also act on the website but are not included; list those with `organizationId`. Provide either this or `organizationId`.
- `revoked` 'exclude' | 'only'
- `cursor` string
- `limit` integer

## Response `200`

One page of API keys, newest first.

- object
  - `items` object[], required
    - `id` string, required: Unique id of the API key.
    - `name` string, required: Human-readable label, 1–200 characters.
    - `organizationId` string, required: Id of the organization that owns the key.
    - `access` union, required: Access configuration of an API key: either one organization-wide role, or one role across an explicit set of websites. The `owner` role can never be granted to an API key.
      - object
        - `kind` 'organization', required: Grants one role across the entire organization.
        - `role` 'admin' | 'full_editor' | 'content_editor', required: Organization-wide role held by the key.
      - object
        - `kind` 'websites', required: Grants one role on an explicit set of websites.
        - `websiteIds` string[], required: Ids of the websites the key can access. All must belong to the organization of the key.
        - `role` 'content_editor' | 'full_editor', required: Role held by the key on each listed website.
    - `expiresAt` string, date-time, nullable, required: When the key stops authenticating. `null` when it never expires.
    - `revokedAt` string, date-time, nullable, required: When the key was revoked. `null` while the key is active.
    - `createdAt` string, date-time, required: When the key was created.
  - `nextCursor` string, nullable, required: Opaque cursor for the next page. Pass it as the `cursor` parameter on the next request. `null` when this is the last page.

## Other responses

- `400`: Validation failed. The response `message` names the first invalid field.
- `401`: Missing, invalid, expired, or revoked API key.
- `403`: The authenticated principal lacks the required capability.
- `404`: The resource does not exist or is outside the principal’s access scope.
- `429`: Rate limit exceeded. Retry after the number of seconds in the `Retry-After` header.

---

[API](https://skmtc.dev/cactal/apis/cactal-api.md) · [All operations](https://skmtc.dev/cactal/apis/cactal-api/llms.txt) · [OpenAPI document](https://skmtc.dev/cactal/apis/cactal-api/revisions/9cd0fb5eacdd?raw)