---
title: "Retrieve one"
method: GET
path: "/v1/sii/keys/{sii_key_id}"
tags: ["SII Key"]
---

# Retrieve one

`GET /v1/sii/keys/{sii_key_id}`

Returns a single SII key by id. Sensitive credential fields (`password`,
`certificate_password`) are stripped; the response includes the computed
`can_issue?` and `company_ids` fields.

## Path parameters

- `sii_key_id` string, uuid, required

## Parameters

- `#/paths/~1v1~1sii~1keys/get/parameters/0` — unresolved $ref

## Response `200`

The requested SII key.

- SiiKey
  - `id` string, uuid, required — UUID of the SII key.
  - `rut` string, required — Tax id (RUT) the certificate belongs to, stored as bare digits plus the verifier digit (e.g. `761234567` or `12345678K`). Unique across all SII keys.
  - `user_id` string, nullable — Firebase user id of the person who provided the credential.
  - `status` 'approved' | 'pending' | 'canceled' | 'declined', required — Lifecycle status of the credential. | Value | Meaning | | ----- | ------- | | `pending` | Just created; Cardda has not yet validated it against the SII. | | `approved` | Validated; the key can sync companies and invoices. | | `declined` | The SII rejected the credentials (`auth/wrong-credentials`). | | `canceled` | The credential was disabled. |
  - `issuer_phone` integer, nullable — Phone number registered for the issuer, when captured.
  - `last_synced_at` string, date-time, nullable — Timestamp of the last successful invoice/company sync.
  - `can_issue` boolean — Whether the key can issue electronic documents — true when `status` is `approved` **and** a certificate password is present. **Note:** this field is serialized with a trailing question mark in the JSON response (`can_issue?`).
  - `company_ids` string[] — UUIDs of the companies this key manages (resolved through the SII managers join). Present on the list and detail responses; omitted from the update response.
  - `created_at` string, date-time — When the key was created in Cardda.
  - `updated_at` string, date-time — When the key was last updated.

## Other responses

- `401` — Unauthorized — missing/invalid token, or the caller lacks `sii_keys_view`/`sii_keys_manage` on a company the key manages and does not own the key. Auth is by key ownership or permission; the `company-id` header is not used to scope this operation. Empty body.
- `404` — SII key not found (or not visible to the caller). Body: `{ "message": "Resource not found" }`.

---

[API](https://skmtc.dev/cardda/apis/banking-api.md) · [All operations](https://skmtc.dev/cardda/apis/banking-api/llms.txt) · [OpenAPI document](https://skmtc.dev/cardda/apis/banking-api/revisions/ff1aeb3fda8b?raw)