ApiKeys

List API keys

Returns all API keys for the authenticated project as a JSON array (never null). The plaintext key value is never included — only the non-secret prefix.

get/api/v1/api-keys

Request

  • Base URL: https://app.lastping.dev
  • URL: https://app.lastping.dev/api/v1/api-keys
  • Auth: API key in header X-Api-Key

Response

Array of API keys (may be empty).

idstring uuid

Unique API key identifier.

namestring

Human-readable label for the key.

prefixstring

First 10 characters of the key — a non-secret identifier shown in place of the full value.

created_atstring date-time

RFC 3339 UTC timestamp when the key was created.

expires_atstring date-time

RFC 3339 UTC expiry timestamp, or omitted for a key that never expires.

last_used_atstring date-time

RFC 3339 UTC timestamp of the most recent request this key authenticated. Omitted if the key has never been used since this field was added — never rendered as a zero/epoch time.

last_used_surface'mcp' | 'terraform' | 'api' | 'ingest'

Which client surface last used this key, omitted if unknown. ingest means the latest use was sending telemetry (traces, metrics or logs); telemetry use is recorded about once a minute per key, so last_used_at can trail the newest export by up to a minute. For mcp, terraform and api the value is best-effort and spoofable: derived from the caller-controlled User-Agent header on the authenticating request, not from any cryptographic or protocol-level signal. Useful for an honest "did my client ever successfully authenticate?" indicator — never use it for authorization or access control.

scope'read' | 'write' | 'admin' | 'ingest'

What this key is permitted to do. Always present. Unlike last_used_surface above — which is a spoofable hint derived from a caller-supplied header — this is the value the server actually checks. ingest sends telemetry only and cannot call this API.

check_idstring uuid

The one monitor an ingest key is bound to. Omitted for an unbound key and for every key of another scope.

created_by_key_idstring uuid

The API key that minted this one, omitted for a key created from the dashboard (which has no parent key) or whose parent has since been deleted.

Revoking a key revokes every key below it in this chain. A key minted by a key minted by the key you delete goes with it, all at once. A key created from the dashboard is never below anything and is unaffected.

Example response

[
  {
    "id": "e1d2c3b4-0000-0000-0000-000000000001",
    "name": "github-actions",
    "prefix": "lp_Wwut111",
    "created_at": "2026-07-01T12:00:00Z",
    "expires_at": "2026-12-31T00:00:00Z",
    "last_used_at": "2026-08-01T09:30:00Z",
    "last_used_surface": "mcp",
    "scope": "write",
    "check_id": "6ba7b810-9dad-11d1-80b4-00c04fd430c8",
    "created_by_key_id": "e1d2c3b4-0000-0000-0000-000000000002"
  }
]

Changes

No recorded changes to this operation across all 2 revisions of this API.