List API keys (headers only)

The GET of this path with no response body. It is authorized exactly as the GET is and answers its statuses and headers, never a body: an error’s correlation is in X-Request-ID alone. Range is ignored. It runs the GET’s own read and discards the body, so it touches whatever that read touches, the guest included: it is not a lighter way to poll.

Requires the viewer role or higher.