API keys

List API keys

Your API keys on this account, newest first. Needs a key with manage_keys on: that is set for a key from the dashboard (Settings → Credentials → API keys → the key’s menu → Allow managing keys), is off for every key until then, and every other key is refused this route with 403.

Only the holder’s own keys, and only those acting on this account. A key confined to a workspace lists the keys confined to that same workspace and no others.

Requires the viewer role or higher.

get/api-keys

Request

  • Base URL: https://app.mandala.computer/api/v1
  • URL: https://app.mandala.computer/api/v1/api-keys
  • Auth: HTTP bearer

Response

The keys, newest first. The raw keys are never listed.

idstring required

key- and twelve hex characters. What an audit entry names as apikey:<id>.

namestring nullable required

Its label, up to 60 characters, or null when it was minted without one. For a hosted-MCP (OAuth) credential, which only GET /whoami answers, Connected app: followed by the connected app’s name, up to 100 characters in all.

prefixstring required

The first twelve characters of the key and an ellipsis, for recognising it. Not a secret. oauth for a hosted-MCP (OAuth) credential, as GET /whoami answers it.

created_atstring required

RFC 3339 timestamp.

last_used_atstring nullable required

RFC 3339 timestamp of its last authenticated request, or null until it has one.

workspace_idstring nullable required

The workspace it is confined to, or null for the whole account.

workspace_namestring nullable required

That workspace’s name, or null for an account-wide key.

manage_keysboolean required

Whether this key may use /api-keys. With it a key lists its holder’s keys; creating and revoking also need the holder to be a member or owner, so a viewer’s key can only list. Set only from the dashboard; no key can set it.

minted_by_key_idstring nullable required

The id of the API key that minted this one over the API, or null for a key minted from the dashboard. Kept after that key is revoked.

Changes

No recorded changes to this operation across all 1 revision of this API.