---
title: "List your API keys"
method: GET
path: "/accounts/{account}/api-keys"
tags: ["Account"]
---

# List your API keys

`GET /accounts/{account}/api-keys`

## Request

- Base URL: `https://api.factuarea.com/v1`
- URL: `https://api.factuarea.com/v1/accounts/{account}/api-keys`
- Auth: one of:
  - HTTP bearer
  - API key in header `X-API-Key`

List the API keys of your account with cursor-based pagination; the plaintext secret is never returned.
- Each key exposes `prefix`, `scopes`, `tier`, `environment` (`live`/`test`) and lifecycle timestamps.
- A key is listed only when every tax ID of its scope is within the calling credential’s scope.
- An account identifier that is not yours returns 404.

## Path parameters

- `account` string, uuid, required

## Headers

- `Factuarea-Version` string, date

## Response `200`

`ApiKeyListV1Resource`

- object: Cursor-paginated list of API keys (`{ data, has_more, next_cursor }`).
  - `data` object[], required: Page of API keys.
    - `id` string, uuid, required: Opaque identifier (UUID v7) of the API key.
    - `object` 'api_key', required: Always `api_key`.
    - `name` string, required: Human-friendly label assigned at creation time.
    - `prefix` string, required: First chars of the key (e.g. `fact_live_1N0Fnyhh`) — safe to log. Does NOT authenticate.
    - `scopes` string[], required: Authorized scopes. `*` means super scope (full access).
    - `tier` string, required: Rate-limit tier (`free`, `starter`, `pro`, `scale`). Derived from the company plan (or preserved by historical grandfathering), never set from the request body.
    - `environment` 'live' | 'test', required: Key environment: `live` (`fact_live_`, real side effects) or `test` (`fact_test_`, sandbox company, no real-world effects).
    - `created_at` string, date-time, required
    - `last_used_at` string, date-time, nullable, required: Timestamp of the last authenticated request with this key, or `null` if never used.
    - `expires_at` string, date-time, nullable, required: Expiry instant (ISO 8601), or `null` if the key does not expire.
    - `revoked_at` string, date-time, nullable, required: Revocation instant (ISO 8601), or `null` if the key is not revoked.
    - `is_active` boolean, required: `true` when the key is usable (not revoked and not expired).
    - `is_revoked` boolean, required: `true` once the key has been revoked.
    - `ip_allowlist` string[], nullable, required: IP addresses or CIDR ranges the key is restricted to, or `null` when it has no IP restriction.
    - `allowed_origins` string[], nullable, required: Browser origins allowed to use a browser-published key, or `null` (or empty) when the key is server-side only.
    - `last_used_ip` string, nullable, required: IP address of the last authenticated request with this key, or `null` if never used.
    - `nif_scope` ApiKeyNifScopeItem[], required: Tax IDs the key reaches, each with its opaque identifier, its fiscal identifier and the access level stored for the key on it.
      - `id` string, uuid, required: Opaque identifier of the company (UUID v7) — the one the company axis expects in the path.
      - `tax_id` string, required: Spanish fiscal identifier (NIF, CIF, NIE). Structural format: NIF `^\d{8}[A-Z]$`, NIE `^[XYZ]\d{7}[A-Z]$`, CIF `^[A-Z]\d{7}[A-Z0-9]$`. AEAT control-digit (checksum) validation is enforced when the request opts in via the `Factuarea-Version` header on or after the activation version; without that opt-in the legacy permissive behaviour is preserved.
      - `name` string, required
      - `access_level` 'view' | 'operate': Access level the key has on that tax ID: `view` is read-only, `operate` can also write. Present on the scope of an API key.
    - `created_by` object, nullable, required: The person who created the key. `null` when that person no longer belongs to the account, or for keys created before this field existed.
      - `id` string, uuid, required: Opaque identifier (UUID v7) of the person.
      - `name` string, required: Full name of the person.
    - `revoked_by` object, nullable, required: The person who revoked the key. `null` when the key is not revoked, when that person no longer belongs to the account, or for keys revoked before this field existed.
      - `id` string, uuid, required: Opaque identifier (UUID v7) of the person.
      - `name` string, required: Full name of the person.
    - `revoke_reason` string, nullable, required: Reason stored when the key was revoked, or `null`.
    - `secret_rotated_at` string, date-time, nullable, required: Instant of the last secret rotation, or `null` if the secret was never rotated.
    - `secret_rotated_by` object, nullable, required: The person who last rotated the secret. Always `null` when the rotation was made with an API credential or the MCP server instead of a person.
      - `id` string, uuid, required: Opaque identifier (UUID v7) of the person.
      - `name` string, required: Full name of the person.
    - `previous_secret_valid_until` string, date-time, nullable, required: End of the 24-hour grace window in which the previous secret still authenticates after a rotation, or `null` outside that window.
  - `has_more` boolean, required: `true` when more keys exist beyond this page.
  - `next_cursor` string, nullable, required: Opaque cursor for the next page, or `null` when `has_more` is `false`.

## Other responses

- `400`: `parameter_unknown` with `subcode` `retired_active_profile_header`: the retired `X-Active-Profile` header was sent; the company goes in the path. `parameter_invalid_format` on `Factuarea-Version`: the header is not a `YYYY-MM-DD` date. `unsupported_api_version`: the `Factuarea-Version` date is not a supported version.
- `401`: Missing or invalid API key.
- `403`: The request is authenticated but not allowed: the API key lacks the required scope (`insufficient_scope`), the plan does not include the public API or this feature (`addon_not_active`, `feature_not_available_in_plan`), or the module is not available with a test key (`module_not_available_in_sandbox`).
- `404`: The requested resource does not exist or belongs to another company. `account_not_found`: the account in the path does not exist or is not the account of the API key.
- `429`: Rate limit exceeded. Retry after the duration in `Retry-After`.
- `500`: Unexpected server error.

---

[API](https://skmtc.dev/factuarea/apis/factuarea-public-api.md) · [All operations](https://skmtc.dev/factuarea/apis/factuarea-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/factuarea/apis/factuarea-public-api/revisions/718e77934422?raw)