---
title: "List delegated signing keys"
method: GET
path: "/auth/delegated-keys"
tags: ["Embedded Wallet Auth"]
---

# List delegated signing keys

`GET /auth/delegated-keys`

## Request

- Base URL: `https://api.lightspark.com/grid/2025-10-13`
- URL: `https://api.lightspark.com/grid/2025-10-13/auth/delegated-keys`
- Auth: HTTP basic

List delegated signing keys for an Embedded Wallet internal account, a card funding source, or both, including `PENDING` keys (user created but policy leg never completed) and `REVOKED` keys. At least one of `accountId` or `fundingSourceId` must be supplied.

## Query parameters

- `accountId` string
- `fundingSourceId` string

## Response `200`

Delegated keys matching the supplied filters. Returns an empty `data` array when no matching delegated keys are visible to the caller.

- DelegatedKeyListResponse
  - `data` DelegatedKey[], required: Delegated signing keys matching the list filters.
    - `id` string, required: Grid-issued `DelegatedKey:<uuid>` identifier.
    - `cardId` string: The card this key is delegated for. Present only for card keys.
    - `fundingSourceId` string: The card funding source this key is delegated for. Present only for card keys.
    - `agentId` string: The agent this key is delegated for. Present only for agent keys.
    - `accountId` string, required: The Embedded Wallet internal account this key is delegated for, derived from the card funding source or the agent's customer.
    - `publicKey` string, required: Compressed P-256 public key (hex) of the delegated API keypair.
    - `nickname` string, required: Human-readable label for the delegated key.
    - `status` 'PENDING' | 'ACTIVE' | 'REVOKED', required: Status of a delegated signing key. - `PENDING`: The delegated user exists but the policy-creation leg never completed. The key cannot sign. - `ACTIVE`: The policy is granted and the key may stamp quote executions. - `REVOKED`: The delegated user has been deleted and the key can no longer sign.
    - `createdAt` string, date-time, required: When the delegated key was created.
    - `updatedAt` string, date-time, required: When the delegated key was last updated.

## Other responses

- `400`: Bad request
- `401`: Unauthorized
- `500`: Internal service error

## Changes

> 115 revisions in range; 2 not diffed.

- **2026-10-28** `d996ddfb9d2b`: 2 info
  - added the optional property `details/missingFields` to the response with the `400` status
  - added the optional property `details/refusalReason` to the response with the `400` status
- **2026-10-24** `715332dcb111`: 1 warning
  - added the new `EXACT_AMOUNT_UNAVAILABLE` enum value to the `code` response property for the response status `400`
- **2026-10-20** `761d1d030cb5`: 1 warning
  - added the new `CARDHOLDER_AGREEMENT_NOT_ACCEPTED` enum value to the `code` response property for the response status `400`
- **2026-10-13** `ddcb4ec73fd0`: 1 warning
  - added the new `ACCOUNTHOLDER_AGREEMENT_NOT_ACCEPTED` enum value to the `code` response property for the response status `400`
- **2026-10-05** `6d67fe99049c`: 3 info
  - removed the `INVALID_PAYREQ_RESPONSE` enum value from the `code` response property for the response status `400`
  - removed the `LOOKUP_REQUEST_FAILED` enum value from the `code` response property for the response status `400`
  - removed the `QUOTE_REQUEST_FAILED` enum value from the `code` response property for the response status `400`

[Operation history](https://skmtc.dev/lightsparkdev/apis/grid-api/changes/auth/delegated-keys/get.md)

---

[API](https://skmtc.dev/lightsparkdev/apis/grid-api.md) - [All operations](https://skmtc.dev/lightsparkdev/apis/grid-api/llms.txt) - [OpenAPI document](https://skmtc.dev/lightsparkdev/apis/grid-api/revisions/7a1db46ec552?raw)