---
title: "List API keys"
method: POST
path: "/apiKeys.list"
tags: ["ApiKeys"]
---

# List API keys

`POST /apiKeys.list`

## Request

- Base URL: `https://app.getoutline.com/api`
- URL: `https://app.getoutline.com/api/apiKeys.list`
- Auth: one of:
  - HTTP bearer
  - OAuth 2
    - Authorization code: `https://app.getoutline.com/oauth/authorize`
    - Token URL: `https://app.getoutline.com/oauth/token` scopes: `read`, `write`

List API keys for the authenticated user, or for all users in the workspace when called by an administrator. The secret key `value` is never included in this response.

## Request body

- object
  - `offset` number
  - `limit` number
  - `sort` string
  - `direction` 'ASC' | 'DESC'
  - `userId` string, uuid: Filter to keys belonging to this user (admin only).
  - `query` string: Filter to keys whose name matches this search term.

## Response `200`

OK

- object
  - `data` ApiKey[]
    - `id` string, uuid: Unique identifier for the object.
    - `name` string: A user provided name for the API key.
    - `scope` string[], nullable: An optional list of scopes that restrict which endpoints the key can access. When `null` the key has access to all endpoints available to the user.
    - `last4` string: The last four characters of the key, used to help identify it.
    - `value` string: The full secret value of the key. Only returned once, in the response to `apiKeys.create`.
    - `expiresAt` string, date-time, nullable: Date and time when this key expires, if ever.
    - `lastActiveAt` string, date-time, nullable: Date and time when this key was last used.
    - `createdAt` string, date-time: Date and time when this key was created.
    - `updatedAt` string, date-time: Date and time when this key was last updated.
  - `pagination` Pagination
    - `offset` number
    - `limit` number
  - `policies` Policy[]
    - `id` string, uuid: Unique identifier for the object this policy references.
    - `abilities` object: The abilities that are allowed by this policy, if an array is returned then the individual ID's in the array represent the memberships that grant the ability.

## Other responses

- `401`: The API key is missing or otherwise invalid.
- `403`: The current API key is not authorized to perform this action.
- `429`: The request was rate limited.

## Changes

- **2026-09-05** `6287bce7caad`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/defaulr/apis/outline-api/changes/apiKeys.list/post.md)

---

[API](https://skmtc.dev/defaulr/apis/outline-api.md) - [All operations](https://skmtc.dev/defaulr/apis/outline-api/llms.txt) - [OpenAPI document](https://skmtc.dev/defaulr/apis/outline-api/revisions/5ddf01ffba84?raw)