---
title: "List the org's API keys"
method: GET
path: "/o/{org}/api-keys"
tags: ["API keys"]
---

# List the org's API keys

`GET /o/{org}/api-keys`

## Request

- Base URL: `https://api.prix.dev`
- URL: `https://api.prix.dev/o/{org}/api-keys`
- Auth: HTTP bearer

Every live key, without its secret, with the runs it started in the last seven days (`stats`), and every MCP client connected through OAuth (`kind` `oauth`) whose refresh token has not lapsed. Org admins only, signed in; an API key cannot call this.

## Response `200`

The keys.

- object
  - `data` ApiKey[], required
    - `id` string, required: `key_…`; use it in the key routes.
    - `kind` 'key' | 'oauth': `key` is minted here; `oauth` is an MCP client a person connected by signing in. An `oauth` grant reaches only the MCP server, cannot be rotated and has no webhook; its `expires_at` is when it ends unless the client refreshes it.
    - `name` string, required
    - `prefix` string, required: The secret's first characters, to tell keys apart.
    - `scopes` ApiKeyScope[], required
    - `max_concurrent` integer, required
    - `webhook_url` string, nullable, required
    - `expires_at` string, date-time, nullable, required
    - `created_by` object, required
      - `id` string, required
      - `email` string, nullable, required
    - `last_used_at` string, date-time, nullable, required
    - `created_at` string, date-time, required
    - `stats` object: The runs the key started in the last seven days. Only in the list. `finished` counts runs that ended `completed` or `needs_review`, out of `ended`. `webhook_deliveries` is the state of each run's latest completion webhook: delivered, still being retried, or dropped after the last try.
      - `since` string, date-time, required
      - `runs` integer, required
      - `finished` integer, required
      - `ended` integer, required
      - `spend_usd` number, required
      - `mcp_runs` integer, required: Of `runs`, those started through MCP.
      - `webhook_deliveries` object, required
        - `delivered` integer, required
        - `retrying` integer, required
        - `failed` integer, required
    - `secret` string: The key's secret. Only in the create and rotate responses; never shown again.
    - `webhook_secret` string: The webhook signing secret. Only in the update response that minted it.

## Other responses

- `401`: No bearer, an unknown, revoked or expired one, or an API key on a route keys cannot call.
- `404`: No such resource for the caller, including one in an org the caller is not in or a Project that is private to someone else.

---

[API](https://skmtc.dev/getrush/apis/rush-api.md) · [All operations](https://skmtc.dev/getrush/apis/rush-api/llms.txt) · [OpenAPI document](https://skmtc.dev/getrush/apis/rush-api/revisions/e351f947926b?raw)