---
title: "Every connected account, with the kept sign-ins and Domain Connect grants"
method: GET
path: "/provider-accounts"
tags: ["Provider accounts"]
---

# Every connected account, with the kept sign-ins and Domain Connect grants

`GET /provider-accounts`

## Request

- Base URL: `https://api.customdomain.ai/v1`
- URL: `https://api.customdomain.ai/v1/provider-accounts`
- Auth: HTTP bearer

The workspace's provider accounts with their access mode, the domains they cover, when they were last used and when they expire, and whether the caller may manage each one (`can_manage`); and, in `kept_access`, the sign-ins and Domain Connect authorizations kept per domain, grouped by provider. A kept sign-in is stopped per domain with `DELETE /connections/{id}/grant`.

## Response `200`

The accounts

- object
  - `accounts` ProviderAccount[], required
    - `id` string, required
    - `kind` 'api_key', required
    - `provider` string, required
    - `provider_name` string, required
    - `label` string, required
    - `access` 'continuous' | 'one_time', required
    - `scope` 'all' | 'selected', required
    - `domains` string[], required: The selected zones (scope `selected`).
    - `credential_held` boolean, required: Whether the key is still kept and usable (false for a one time account past its hour). The key itself is never returned.
    - `status` 'active' | 'used' | 'expired' | 'needs_reconnect', required
    - `last_error` string
    - `created_by` string
    - `last_used_at` string, date-time
    - `expires_at` string, date-time: When a one time account's key is deleted at the latest.
    - `created_at` string, date-time, required
    - `updated_at` string, date-time
    - `connections` AccountConnection[], required
      - `id` string
      - `application_id` string
      - `domain` string
      - `status` string
    - `uses` string[], required: What the account's access is used for.
    - `can_manage` boolean, required: Whether the caller may change the account's access, scope or domains, connect domains with it and replace its key: an admin, an owner, or the member who connected it.
  - `kept_access` object[], required
    - `kind` 'sign_in' | 'domain_connect'
    - `provider` string
    - `provider_name` string
    - `access` 'continuous'
    - `connections` AccountConnection[]
      - `id` string
      - `application_id` string
      - `domain` string
      - `status` string
    - `created_at` string, date-time
    - `last_used_at` string, date-time
    - `uses` string[]
  - `keeping_available` boolean, required: Whether this deployment can keep keys (GRANT_ENCRYPTION_KEY is set).

## Other responses

- `401`: Error envelope: {code, title, details}.

---

[API](https://skmtc.dev/customdomain/apis/customdomain-control-plane-api.md) · [All operations](https://skmtc.dev/customdomain/apis/customdomain-control-plane-api/llms.txt) · [OpenAPI document](https://skmtc.dev/customdomain/apis/customdomain-control-plane-api/revisions/34d89cb7a7cd?raw)