---
title: "List the organization's API keys."
method: GET
path: "/v1/api-keys"
tags: ["auth"]
---

# List the organization's API keys.

`GET /v1/api-keys`

## Request

- Base URL: `http://localhost:8080`
- URL: `http://localhost:8080/v1/api-keys`
- Auth: one of:
  - API key in cookie `dvt_session`
  - HTTP bearer

Non-secret fields only — the plaintext is never retrievable. Admin/owner (apikey:manage) returns all keys in the org. Members may list only their own keys when the org has `allowMemberApiKeys` enabled (see `GET /v1/me` → `org.allowMemberApiKeys`).

## Response `200`

The org's keys, newest first.

- object
  - `data` ApiKey[]
    - `id` string, uuid, required
    - `name` string, required
    - `prefix` string, required: Non-secret identifier, e.g. dvt_live_ab12cd34.
    - `scopes` string[], required: The `resource:action` capabilities a request made with this key may exercise, intersected with the creator's role (DVT-33). Empty = no narrowing: the key holds its creator's full role capabilities. A key can never exceed its creator's role. The vocabulary is the capability set (mirrors Me.capabilities); this enum is drift- locked against the authz capability constants. `certification:manage`, `dashboard:certify` and `dashboard:canonicalize` appear here only because the enum mirrors the full capability set: certification cannot be granted via a delegated dvt credential (ADR-0085 D6), so minting a key scoped to any of them is rejected with 400.
    - `createdAt` string, date-time, required
    - `lastUsedAt` string, date-time
    - `expiresAt` string, date-time
    - `revokedAt` string, date-time
    - `creatorId` string, uuid: The user who created (owns) this key.
    - `creatorName` string: Display name of the creator, if set. Presentation label, not an identifier — machine logins are humanized for display (DVT-2298).
    - `creatorEmail` string, email: Email of the creator.
  - `meta` Meta: Response metadata.
    - `requestId` string, required: Correlates with the X-Request-Id header.
    - `total` integer: Item count, present on collection responses.
    - `nextCursor` string, nullable: Opaque keyset-pagination cursor, present on paginated responses (e.g. GET /v1/dashboards) when more rows exist beyond this page. Pass it back as the `cursor` query param to fetch the next page; absent or null on the last page.
    - `roleResolveDegraded` boolean: Snowflake mode only (DVT-2260), on GET /v1/dashboards: present and true when the caller's live Snowflake role resolution failed or was unavailable — role-shared dashboards may be missing from this page. Omitted (not merely false) whenever resolution succeeded or the role-share arm does not apply (off snowflake mode, an org admin/owner, or off the ingress listener).

## Other responses

- `401`: Missing, invalid, or expired session.
- `403`: Caller's role is below admin.

---

[API](https://skmtc.dev/dvt/apis/dvt-rest-api.md) · [All operations](https://skmtc.dev/dvt/apis/dvt-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/dvt/apis/dvt-rest-api/revisions/00016f504165?raw)