---
title: "Describe the API key used for this request"
method: GET
path: "/rest/api/v1/apiKeys/current"
tags: ["Key Management API"]
---

# Describe the API key used for this request

`GET /rest/api/v1/apiKeys/current`

Returns the key that authenticated this call, including its permission type and access policy, so a caller can tell what it may do before attempting it. The key value itself is never returned. Requires an API key; a session-authenticated call has no key to describe.

## Response `200`

OK

- ApiKeyDTO
  - `accessPolicy` ApiKeyAccessPolicyDTO — Access policy configuration for this API key. Controls which AccountInformationDTO fields are visible and which endpoints are accessible.
    - `allowedCorsOrigins` string[] — List of allowed CORS (Cross-Origin Resource Sharing) domains. If specified, only requests from these origins will be allowed. Supports wildcards. Examples: 'https://example.com', 'https://*.example.com', 'http://localhost:3000'. If null or empty, all origins are allowed.
    - `allowedIpAddresses` string[] — List of allowed IP addresses or CIDR subnets. If specified, only requests from these IPs will be allowed. Supports both IPv4 and IPv6. Examples: '192.168.1.100', '10.0.0.0/24', '2001:db8::/32'. If null or empty, all IPs are allowed.
    - `enabled` boolean — Whether the access policy is enabled. If false, all restrictions are disabled and the API key has full access. Default is true.
    - `endpointPolicyMode` 'ALLOW_LIST' | 'DENY_LIST' — Endpoint access policy mode: ALLOW_LIST (only listed endpoints are accessible) or DENY_LIST (listed endpoints are blocked). Default is ALLOW_LIST if not specified.
    - `endpoints` ApiKeyEndpointDTO[] — List of REST endpoints with their HTTP methods. Supports wildcards: '*' for single segment, '**' for multiple segments, '{variable}' for path variables. Examples: '/rest/api/v1/projects/*' matches any direct child, '/rest/api/v1/projects/**' matches all descendants. Behavior depends on endpointPolicyMode: ALLOW_LIST = only these endpoints accessible, DENY_LIST = these endpoints blocked.
      - `method` 'GET' | 'POST' | 'PUT' | 'DELETE', required — HTTP method
      - `path` string, required — REST endpoint path pattern. Supports wildcards: '*' matches one path segment, '**' matches multiple segments, '{variable}' matches path variables. Examples: '/rest/api/v1/projects/*', '/rest/api/v1/projects/**', '/rest/api/v1/projects/{projectId}/strategies'
    - `fieldPolicyMode` 'ALLOW_LIST' | 'DENY_LIST' — Field access policy mode: ALLOW_LIST (only listed fields are visible) or DENY_LIST (listed fields are hidden). Default is DENY_LIST if not specified.
    - `fields` FieldMetadataDTO[] — List of DTO fields with their class name and field name. Allows filtering fields from multiple DTOs. Behavior depends on fieldPolicyMode: ALLOW_LIST = only these fields visible, DENY_LIST = these fields hidden. If null or empty and mode is ALLOW_LIST, no fields are visible. If null or empty and mode is DENY_LIST, all fields are visible.
      - `description` string — Field description from @Schema annotation if available
      - `dtoClassName` string — The DTO class name this field belongs to
      - `fieldName` string — Field name
      - `fieldType` string — Field Java type
    - `hiddenFrontendFeatures` string[] — List of frontend features to hide from the user interface. Frontend application should check this list and hide corresponding UI components. Examples: FINANCIAL_OVERVIEW to hide balance, equity, profit displays.
  - `accountId` string, uuid — You have to set it during resource creation, after that, it is only read-only
  - `alias` string
  - `expiresAt` string, date-time — Point in time after which this key is rejected. Null means the key never expires.
  - `id` integer
  - `key` string
  - `keyType` 'INTEGRATION' | 'AI' — Key type: INTEGRATION or AI. At most one AI key per project; setting it on a second key clears the flag on the first. AI keys fail closed without an access policy and cannot be turned back into INTEGRATION keys.
  - `lastUsedAt` string, date-time — Last time this key was accepted on a request. Updated at most once per minute.
  - `permissionType` 'READ_WRITE' | 'READ_ONLY' — Permission type: READ_WRITE or READ_ONLY
  - `projectId` string, uuid — You have to set it during resource creation, after that, it is only read-only
  - `revokedAt` string, date-time — Point in time at which this key was revoked. Null means the key is active.

## Changes

- **2026-08-30** `69d2d39c695e` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/metacopier/apis/metacopier-api/changes/rest/api/v1/apiKeys/current/get.md)

---

[API](https://skmtc.dev/metacopier/apis/metacopier-api.md) · [All operations](https://skmtc.dev/metacopier/apis/metacopier-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/metacopier/metacopier-api/revisions/69d2d39c695e/schema)