---
title: "List all API keys"
method: GET
path: "/api-keys"
tags: ["api-keys"]
---

# List all API keys

`GET /api-keys`

Returns all API keys. Requires admin role.

## Response `200`

List of API keys

- APIKeysListResponse — List of API keys
  - `apiKeys` APIKey[], required
    - `id` string, required — Unique identifier
    - `name` string, required — Human-readable name
    - `description` string — Purpose description
    - `role` 'admin' | 'manager' | 'developer' | 'operator' | 'viewer', required — User role determining access permissions. admin: full access including user management, manager: DAG CRUD and execution with audit log access, developer: DAG CRUD and execution, operator: DAG execution only, viewer: read-only
    - `workspaceAccess` WorkspaceAccess, required — Workspace access policy. all=true grants the top-level role in every workspace. all=false requires explicit workspace grants and a top-level viewer role.
      - `all` boolean, required — Whether this identity can access all workspaces
      - `grants` WorkspaceGrant[], required — Workspace-specific grants used when all=false
        - `workspace` string, required — Workspace name. The reserved names all and default are not allowed.
        - `role` 'admin' | 'manager' | 'developer' | 'operator' | 'viewer', required — User role determining access permissions. admin: full access including user management, manager: DAG CRUD and execution with audit log access, developer: DAG CRUD and execution, operator: DAG execution only, viewer: read-only
    - `keyPrefix` string, required — First 8 characters for identification
    - `createdAt` string, date-time, required — Creation timestamp
    - `updatedAt` string, date-time, required — Last update timestamp
    - `createdBy` string, required — Creator user ID
    - `lastUsedAt` string, date-time, nullable — Last authentication timestamp

## Other responses

- `401` — Not authenticated
- `403` — Requires admin role
- `default` — Error

## Changes

- **2026-04-30** (v1) `50e1d517afc1` — 2 breaking, 5 warning, 3 info
  - removed the required property `apiKeys/items/allowedSurfaces` from the response with the `200` status
  - removed the required property `apiKeys/items/attributionClass` from the response with the `200` status
  - removed the optional property `apiKeys/items/migratedAsServiceAccount` from the response with the `200` status
  - removed the optional property `apiKeys/items/ownerUserId` from the response with the `200` status
  - …6 more

[Change history](https://skmtc.dev/dagucloud/apis/dagu/changes/api-keys/get.md)

---

[API](https://skmtc.dev/dagucloud/apis/dagu.md) · [All operations](https://skmtc.dev/dagucloud/apis/dagu/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/dagucloud/dagu/revisions/0cce8472f3ba/schema)