--- title: "List application credentials" method: GET path: "/zones/{zoneId}/application-credentials" tags: ["Application Credentials"] --- # List application credentials `GET /zones/{zoneId}/application-credentials` ## Request - Base URL: `https://docs.keycard.ai` (the document declares no server; this is the origin it was published from) - URL: `https://docs.keycard.ai/zones/{zoneId}/application-credentials` - Auth: one of: - HTTP bearer - OAuth 2 - Client credentials - Token URL: `/service-account-token` Returns a paginated list of application credentials in the specified zone. Use cursor pagination via `after`/`before`. Use `expand[]=total_count` to include the matching row count. Search via `query[identifier]`, `query[provider_name]`, or `query[]` (identifier or provider name); all are substring matches, OR'd across repeated values. ## Path parameters - `zoneId` string, required ## Query parameters - `slug` string - `applicationId` string - `after` string - `before` string - `limit` integer - `expand[]` union - 'total_count' - string[] - `filter[owner_type][ne]` 'platform' | 'customer' - `filter[traits][ne]` union - string - string[] - `filter[type]` union - 'token' | 'password' | 'public-key' | 'url' | 'public': Filter by credential type; repeated values are OR'd, e.g. `filter[type]=token&filter[type]=password`. - string[] - `query[identifier]` union - string: Search by credential identifier (substring match, OR'd across repeated values) - string[] - `query[provider_name]` union - string: Search by the linked provider's name (substring match, OR'd across repeated values) - string[] - `query[]` union - string: Search across credential identifier and linked provider name (substring match, OR'd across repeated values) - string[] - `sort` string ## Response `200` Default Response - object - `items` IamApplicationCredential[], required - union: Credentials for accessing external services from applications - IamApplicationCredentialToken: Common fields shared by all application credential types - `id` string, required: Unique identifier of the credential - `organization_id` string, required: Organization that owns this credential - `zone_id` string, required: Zone this credential belongs to - `slug` string, required: URL-safe identifier, unique within the zone - `application_id` string, required: ID of the application this credential belongs to - `application` IamApplication: An Application is a software system with an associated identity that can access Resources. It may act on its own behalf (machine-to-machine) or on behalf of a user (delegated access). - `id` string, required: Unique identifier of the application - `organization_id` string, required: Organization that owns this application - `zone_id` string, required: Zone this application belongs to - `slug` string, required: URL-safe identifier, unique within the zone - `identifier` string, required: User specified identifier, unique within the zone - `name` string, required: Human-readable name - `description` string, nullable: Human-readable description - `metadata` IamMetadata: Entity metadata - `docs_url` string, uri: Documentation URL - `icon_url` string, uri: Icon URL - `protocols` object, nullable: Protocol-specific configuration - `oauth2` IamApplicationOAuth2Protocol, nullable: OAuth 2.0 protocol configuration - … - `dependencies_count` integer, required: Number of resource dependencies - `owner_type` 'platform' | 'customer', required: Who owns this application. Platform-owned applications cannot be modified via API. - `consent` 'implicit' | 'required', required: Consent mode for the application. 'implicit' means consent is automatically granted, 'required' means explicit user consent is needed. - `created_at` string, date-time, required: Entity creation timestamp - `updated_at` string, date-time, required: Entity update timestamp - `created_at` string, date-time, required: Entity creation timestamp - `updated_at` string, date-time, required: Entity update timestamp - `type` 'token', required - `provider_id` string, required: ID of the provider issuing tokens verified by this credential - `provider` IamProvider: A Provider is a system that supplies access to Resources and allows actors (Users or Applications) to authenticate. - `id` string, required: Unique identifier of the provider - `organization_id` string, required: Organization that owns this provider - `zone_id` string, required: Zone this provider belongs to - `slug` string, required: URL-safe identifier, unique within the zone - `name` string, required: Human-readable name - `description` string, nullable: Human-readable description - `identifier` string, required: User specified identifier, unique within the zone - `type` 'external' | 'keycard-vault' | 'keycard-sts' - `client_id` string, nullable: OAuth 2.0 client identifier - `client_secret_set` boolean: Indicates whether a client secret is configured - `protocols` object, nullable: Protocol-specific configuration - `oauth2` IamProviderOAuth2Protocol, nullable: OAuth 2.0 protocol configuration - … - `openid` IamProviderOpenIDProtocol, nullable: OpenID Connect protocol configuration - … - `metadata` object, nullable: Provider metadata - `icon_url` string, uri: Icon URL - `owner_type` 'platform' | 'customer', required: Who owns this provider. Platform-owned providers cannot be modified via API. - `created_at` string, date-time, required: Entity creation timestamp - `updated_at` string, date-time, required: Entity update timestamp - `identifier` string, required: Identifier for this credential. For token type, this equals the subject value, or '*' when subject is not specified. - `subject` string, nullable: Subject identifier for the token. When null or omitted, any token from the provider is accepted without checking application-specific claims. - IamApplicationCredentialPassword: Common fields shared by all application credential types - `id` string, required: Unique identifier of the credential - `organization_id` string, required: Organization that owns this credential - `zone_id` string, required: Zone this credential belongs to - `slug` string, required: URL-safe identifier, unique within the zone - `application_id` string, required: ID of the application this credential belongs to - `application` IamApplication: An Application is a software system with an associated identity that can access Resources. It may act on its own behalf (machine-to-machine) or on behalf of a user (delegated access). - `id` string, required: Unique identifier of the application - `organization_id` string, required: Organization that owns this application - `zone_id` string, required: Zone this application belongs to - `slug` string, required: URL-safe identifier, unique within the zone - `identifier` string, required: User specified identifier, unique within the zone - `name` string, required: Human-readable name - `description` string, nullable: Human-readable description - `metadata` IamMetadata: Entity metadata - `docs_url` string, uri: Documentation URL - `icon_url` string, uri: Icon URL - `protocols` object, nullable: Protocol-specific configuration - `oauth2` IamApplicationOAuth2Protocol, nullable: OAuth 2.0 protocol configuration - … - `dependencies_count` integer, required: Number of resource dependencies - `owner_type` 'platform' | 'customer', required: Who owns this application. Platform-owned applications cannot be modified via API. - `consent` 'implicit' | 'required', required: Consent mode for the application. 'implicit' means consent is automatically granted, 'required' means explicit user consent is needed. - `created_at` string, date-time, required: Entity creation timestamp - `updated_at` string, date-time, required: Entity update timestamp - `created_at` string, date-time, required: Entity creation timestamp - `updated_at` string, date-time, required: Entity update timestamp - `type` 'password', required - `identifier` string, required: Username for password credential, also used as OAuth 2.0 client ID - `password` string: Password for credential (only returned on creation, store securely), also used as OAuth 2.0 client secret - IamApplicationCredentialPublicKey: Common fields shared by all application credential types - `id` string, required: Unique identifier of the credential - `organization_id` string, required: Organization that owns this credential - `zone_id` string, required: Zone this credential belongs to - `slug` string, required: URL-safe identifier, unique within the zone - `application_id` string, required: ID of the application this credential belongs to - `application` IamApplication: An Application is a software system with an associated identity that can access Resources. It may act on its own behalf (machine-to-machine) or on behalf of a user (delegated access). - `id` string, required: Unique identifier of the application - `organization_id` string, required: Organization that owns this application - `zone_id` string, required: Zone this application belongs to - `slug` string, required: URL-safe identifier, unique within the zone - `identifier` string, required: User specified identifier, unique within the zone - `name` string, required: Human-readable name - `description` string, nullable: Human-readable description - `metadata` IamMetadata: Entity metadata - `docs_url` string, uri: Documentation URL - `icon_url` string, uri: Icon URL - `protocols` object, nullable: Protocol-specific configuration - `oauth2` IamApplicationOAuth2Protocol, nullable: OAuth 2.0 protocol configuration - … - `dependencies_count` integer, required: Number of resource dependencies - `owner_type` 'platform' | 'customer', required: Who owns this application. Platform-owned applications cannot be modified via API. - `consent` 'implicit' | 'required', required: Consent mode for the application. 'implicit' means consent is automatically granted, 'required' means explicit user consent is needed. - `created_at` string, date-time, required: Entity creation timestamp - `updated_at` string, date-time, required: Entity update timestamp - `created_at` string, date-time, required: Entity creation timestamp - `updated_at` string, date-time, required: Entity update timestamp - `type` 'public-key', required - `identifier` string, required: Client ID for public key credential, also used as OAuth 2.0 client ID - `jwks_uri` string, uri, required: JWKS URI to retrieve public keys from - IamApplicationCredentialUrl: Common fields shared by all application credential types - `id` string, required: Unique identifier of the credential - `organization_id` string, required: Organization that owns this credential - `zone_id` string, required: Zone this credential belongs to - `slug` string, required: URL-safe identifier, unique within the zone - `application_id` string, required: ID of the application this credential belongs to - `application` IamApplication: An Application is a software system with an associated identity that can access Resources. It may act on its own behalf (machine-to-machine) or on behalf of a user (delegated access). - `id` string, required: Unique identifier of the application - `organization_id` string, required: Organization that owns this application - `zone_id` string, required: Zone this application belongs to - `slug` string, required: URL-safe identifier, unique within the zone - `identifier` string, required: User specified identifier, unique within the zone - `name` string, required: Human-readable name - `description` string, nullable: Human-readable description - `metadata` IamMetadata: Entity metadata - `docs_url` string, uri: Documentation URL - `icon_url` string, uri: Icon URL - `protocols` object, nullable: Protocol-specific configuration - `oauth2` IamApplicationOAuth2Protocol, nullable: OAuth 2.0 protocol configuration - … - `dependencies_count` integer, required: Number of resource dependencies - `owner_type` 'platform' | 'customer', required: Who owns this application. Platform-owned applications cannot be modified via API. - `consent` 'implicit' | 'required', required: Consent mode for the application. 'implicit' means consent is automatically granted, 'required' means explicit user consent is needed. - `created_at` string, date-time, required: Entity creation timestamp - `updated_at` string, date-time, required: Entity update timestamp - `created_at` string, date-time, required: Entity creation timestamp - `updated_at` string, date-time, required: Entity update timestamp - `type` 'url', required - `identifier` string, uri, required: URL of the credential (must be a valid URL) - IamApplicationCredentialPublic: Common fields shared by all application credential types - `id` string, required: Unique identifier of the credential - `organization_id` string, required: Organization that owns this credential - `zone_id` string, required: Zone this credential belongs to - `slug` string, required: URL-safe identifier, unique within the zone - `application_id` string, required: ID of the application this credential belongs to - `application` IamApplication: An Application is a software system with an associated identity that can access Resources. It may act on its own behalf (machine-to-machine) or on behalf of a user (delegated access). - `id` string, required: Unique identifier of the application - `organization_id` string, required: Organization that owns this application - `zone_id` string, required: Zone this application belongs to - `slug` string, required: URL-safe identifier, unique within the zone - `identifier` string, required: User specified identifier, unique within the zone - `name` string, required: Human-readable name - `description` string, nullable: Human-readable description - `metadata` IamMetadata: Entity metadata - `docs_url` string, uri: Documentation URL - `icon_url` string, uri: Icon URL - `protocols` object, nullable: Protocol-specific configuration - `oauth2` IamApplicationOAuth2Protocol, nullable: OAuth 2.0 protocol configuration - … - `dependencies_count` integer, required: Number of resource dependencies - `owner_type` 'platform' | 'customer', required: Who owns this application. Platform-owned applications cannot be modified via API. - `consent` 'implicit' | 'required', required: Consent mode for the application. 'implicit' means consent is automatically granted, 'required' means explicit user consent is needed. - `created_at` string, date-time, required: Entity creation timestamp - `updated_at` string, date-time, required: Entity update timestamp - `created_at` string, date-time, required: Entity creation timestamp - `updated_at` string, date-time, required: Entity update timestamp - `type` 'public', required - `identifier` string, required: Identifier for public credential, also used as OAuth 2.0 client ID - `page_info` IamPageInfo, required: Pagination information - `has_next_page` boolean, required: Whether there are more items after the current page - `has_previous_page` boolean, required: Whether there are items before the current page - `start_cursor` string, nullable: Cursor pointing to the first item in the current page - `end_cursor` string, nullable: Cursor pointing to the last item in the current page - `pagination` IamPagination, required: Cursor-based pagination metadata - `after_cursor` string, required: An opaque cursor used for paginating through a list of results - `before_cursor` string, required: An opaque cursor used for paginating through a list of results - `total_count` integer: Total number of items matching the query. Only included when expand[]=total_count is requested. ## Other responses - `400`: Error response - `404`: Error response - `default`: Error response ## Changes - **2026-10-29** `0dee67e0a73a`: 3 breaking, 3 warning, 10 info - the `page_info` response's property type changed from `object` to no type for status `200` - removed the required property `page_info/has_next_page` from the response with the `200` status - removed the required property `page_info/has_previous_page` from the response with the `200` status - deleted the `query` request parameter `cursor` - …12 more - **2026-10-16** `0cfaff865771`: 1 warning - removed the optional property `items/items/anyOf[subschema #1: Application Credential Token]/allOf[subschema #2]/provider/allOf[subschema #1: Provider]/protocols/openid/external_id_claim` from the response with the `200` status - **2026-08-26** `d65d51379d93`: 3 info - added the non-success response with the status `404` - added the optional property `items/items/anyOf[subschema #1: Application Credential Token]/allOf[subschema #2]/provider/allOf[subschema #1: Provider]/metadata/icon_url` to the response with the `200` status - added the optional property `items/items/anyOf[subschema #1: Application Credential Token]/allOf[subschema #2]/provider/allOf[subschema #1: Provider]/protocols/openid/external_id_claim` to the response with the `200` status - …earlier changes not shown [Operation history](https://skmtc.dev/keycardai/apis/keycard-ai-keycard-api/changes/zones/:zoneId/application-credentials/get.md) --- [API](https://skmtc.dev/keycardai/apis/keycard-ai-keycard-api.md) - [All operations](https://skmtc.dev/keycardai/apis/keycard-ai-keycard-api/llms.txt) - [OpenAPI document](https://skmtc.dev/keycardai/apis/keycard-ai-keycard-api/revisions/0dee67e0a73a?raw)