---
title: "List toolkits"
method: GET
path: "/toolkits"
tags: ["toolkits"]
---

# List toolkits

`GET /toolkits`

List all toolkits with metadata summary.

Returns all toolkits visible to the caller with key counts and bound credential counts.
Admin users see all toolkits. Agents see only their own toolkit.

Each toolkit includes:
- Metadata (name, description, disabled state, simulation mode)
- Active key count (revoked keys excluded)
- Bound credential count (upstream API credentials available to this toolkit)

The default toolkit implicitly has access to all credentials without explicit binding.

## Response `200`

Successful Response

- ToolkitOut[]
  - `id` string, required — Toolkit ID
  - `name` string, required — Human-readable toolkit name
  - `description` string, nullable — Optional description of this toolkit's purpose
  - `created_at` number, nullable — Unix timestamp when created
  - `disabled` boolean — If true, all API keys for this toolkit are revoked
  - `key_count` integer, nullable — Number of API keys issued for this toolkit
  - `credential_count` integer, nullable — Number of credentials bound to this toolkit
  - `keys` ToolkitKeyOut[] — API keys for this toolkit (if expanded)
    - `id` string, required — Key ID (format: ck_{8chars})
    - `name` string, nullable — User-assigned key name for identification
    - `prefix` string, nullable — Key prefix (always 'tk_' for toolkit keys)
    - `allowed_ips` string[], nullable — IP CIDR ranges allowed to use this key (null = no IP restriction)
    - `revoked` boolean — True if this key has been revoked and can no longer authenticate
    - `created_at` number, nullable — Unix timestamp when key was created
  - `credentials` CredentialBindingOut[] — Credentials bound to this toolkit (if expanded)
    - `credential_id` string, required — Credential ID (format: cred_{12chars})
    - `label` string, nullable — User-assigned credential label
    - `api_id` string, nullable — API ID this credential is for
    - `auth_type` string, nullable — Auth scheme type: bearer, basic, apiKey, oauth2, etc
  - `permissions` object[] — Access control rules for this toolkit

## Changes

- **2026-04-13** `76e8f6063728` — 3 breaking, 3 warning, 12 info
  - the response's body type changed from `object` to `array` for status `200`
  - removed the required property `data` from the response with the `200` status
  - removed the required property `has_more` from the response with the `200` status
  - deleted the `query` request parameter `cursor`
  - …14 more

[Change history](https://skmtc.dev/jentic/apis/jentic-control-plane-api/changes/toolkits/get.md)

---

[API](https://skmtc.dev/jentic/apis/jentic-control-plane-api.md) · [All operations](https://skmtc.dev/jentic/apis/jentic-control-plane-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/jentic/jentic-control-plane-api/revisions/bd463fcefb14/schema)