---
title: "Read the calling API key's authorized sources and result origin"
method: GET
path: "/api-access"
tags: ["API Keys"]
---

# Read the calling API key's authorized sources and result origin

`GET /api-access`

## Request

- Base URL: `https://api.flashdata.dev/v2`
- URL: `https://api.flashdata.dev/v2/api-access`
- Auth: API key in header `X-API-Key`

Free, header-only X-API-Key authentication. Returns only granted public
source names and the configured signed-result storage origin (null if
unavailable). No account ID, key ID, secret or storage credentials are returned.
Local MCP revalidates this endpoint before every tool discovery and call,
including cached result reads. No query parameters or request body are accepted.
All /api-access routes share 120 requests per minute per client IP and return
Cache-Control private, no-store. Normal key last-used tracking still occurs.

## Response `200`

Authorized public sources and result origin

- ApiAccess
  - `sources` ApiAccessSource[], required
  - `result_origin` string, uri, nullable, required: Configured signed-result storage origin, without credentials, path, query or fragment. Not an access token or a media URL.

## Other responses

- `401`: Authentication required or invalid
- `422`: Request validation failed
- `429`: Too many account reads; retry after the rate-limit window
- `503`: A required dependency or catalog is temporarily unavailable

---

[API](https://skmtc.dev/flashdata/apis/flashdata-customer-api.md) · [All operations](https://skmtc.dev/flashdata/apis/flashdata-customer-api/llms.txt) · [OpenAPI document](https://skmtc.dev/flashdata/apis/flashdata-customer-api/revisions/109179fe9313?raw)