---
title: "List a team's API keys"
method: GET
path: "/teams/{id}/keys"
tags: ["API Keys"]
---

# List a team's API keys

`GET /teams/{id}/keys`

## Request

- Base URL: `https://api.indexone.io`
- URL: `https://api.indexone.io/teams/{id}/keys`
- Auth: API key in header `x-api-key` and API key in header `Authorization`

Lists every API Gateway key registered against the team.

**Key values are returned in plaintext** (the handler passes `includeValues=True`), so this response is credential material: never log it, cache it or render it outside an authenticated screen.

As with key creation, a non-member gets HTTP 200 carrying `{"message": "Not authorized to perform this operation"}` instead of a 403.

## Path parameters

- `id` string, required

## Response `200`

The team's keys, values included.

- ApiKey[]
  - `id` string: API Gateway key id — the value passed to `DELETE /teams/{id}/keys/{key_id}`.
  - `value` string: The key itself, in plaintext. Send it as the `x-api-key` header.
  - `created_at` string, date: `YYYY-MM-DD`.
  - `enabled` boolean

## Other responses

- `401`: Missing or invalid id token.
- `403`: Missing or invalid `x-api-key`.
- `429`: API key usage-plan rate limit exceeded.

---

[API](https://skmtc.dev/indexone/apis/index-one-rest-api.md) · [All operations](https://skmtc.dev/indexone/apis/index-one-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/indexone/apis/index-one-rest-api/revisions/df5a92216a9c?raw)