---
title: "List SII keys"
method: GET
path: "/v1/sii/keys"
tags: ["SII Key"]
---

# List SII keys

`GET /v1/sii/keys`

Returns a paginated list of **SII keys** — the digital-certificate credentials
Cardda holds on behalf of a company to operate against Chile's Servicio de
Impuestos Internos (SII).

An SII key is what lets Cardda authenticate to the SII to **sync** the
company's issued/received electronic documents (DTEs), pull PDFs, and submit
acceptance/rejection events. A key becomes usable once its `status` is
`approved`; it can additionally **issue** documents once a certificate
password is present (`can_issue?`).

## Response structure

Sensitive fields (`password`, `certificate_password`) are **never** exposed by
this endpoint — they are stripped from every serialization. Each item adds two
computed fields:

| Field | Description |
| ----- | ----------- |
| `can_issue?` | `true` when `status` is `approved` and a certificate password is stored. Serialized literally with the trailing `?`. |
| `company_ids` | UUIDs of the companies the key manages. |

## Scoping

Results are scoped to the keys the caller can see: keys the caller owns
(`user_id` == caller) plus keys whose managed companies grant the caller the
`sii_keys_view` or `sii_keys_manage` permission.

## Query parameters

- `_start` integer
- `_end` integer
- `_order` 'ASC' | 'DESC'
- `_field` string
- `user_id` string
- `rut` string
- `status` 'approved' | 'pending' | 'canceled' | 'declined'
- `created_at` string

## Headers

- `company-id` string, uuid, required

## Response `200`

Paginated list of SII keys (sensitive fields filtered out). Headers
include `X-Total-Count` and `Content-Range` for offset pagination — see
[Pagination](https://docs.cardda.com/docs/pagination).

- SiiKey[]
  - `id` string, uuid, required — UUID of the SII key.
  - `rut` string, required — Tax id (RUT) the certificate belongs to, stored as bare digits plus the verifier digit (e.g. `761234567` or `12345678K`). Unique across all SII keys.
  - `user_id` string, nullable — Firebase user id of the person who provided the credential.
  - `status` 'approved' | 'pending' | 'canceled' | 'declined', required — Lifecycle status of the credential. | Value | Meaning | | ----- | ------- | | `pending` | Just created; Cardda has not yet validated it against the SII. | | `approved` | Validated; the key can sync companies and invoices. | | `declined` | The SII rejected the credentials (`auth/wrong-credentials`). | | `canceled` | The credential was disabled. |
  - `issuer_phone` integer, nullable — Phone number registered for the issuer, when captured.
  - `last_synced_at` string, date-time, nullable — Timestamp of the last successful invoice/company sync.
  - `can_issue` boolean — Whether the key can issue electronic documents — true when `status` is `approved` **and** a certificate password is present. **Note:** this field is serialized with a trailing question mark in the JSON response (`can_issue?`).
  - `company_ids` string[] — UUIDs of the companies this key manages (resolved through the SII managers join). Present on the list and detail responses; omitted from the update response.
  - `created_at` string, date-time — When the key was created in Cardda.
  - `updated_at` string, date-time — When the key was last updated.

## Other responses

- `401` — Unauthorized — missing or invalid bearer token, or the caller failed the list authorization gate. The gate passes for Cardda staff, for a caller who belongs to the `company-id` header's company, or for a caller who passes their own id as `user_id`. This gate is separate from result **scoping**: holding `sii_keys_view`/`sii_keys_manage` determines which keys appear in the response, but does not by itself authorize the call — a caller with those permissions who sends neither the `company-id` header (for a company they belong to) nor `user_id=<own id>` still receives 401. Pundit failures surface as 401 (not 403) with an empty body.

---

[API](https://skmtc.dev/cardda/apis/banking-api.md) · [All operations](https://skmtc.dev/cardda/apis/banking-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/cardda/banking-api/revisions/ff1aeb3fda8b/schema)