Sign in
API Keys

Get an API key

Returns one live (ACTIVE or EXPIRED) key's metadata — scopes, status, expiry, who minted it. The secret is never returned. Revoked keys are not addressable by label; list with ?status=REVOKED instead.

get/v1/api-keys/{label}

Path parameters

labelstring required

Label of the API key.

Example:ci-runner

Label of the API key.

Response

The API key (metadata only)

labelstring required

Human-readable label. Unique per workspace.

keyPrefixstring required

Display prefix of the key (e.g. "monid_test_a1b2c3d4...").

ownerstring required

User id the key belongs to (bills to, listed under). Always a user; a child key inherits its parent's owner.

createdBystring required

Who minted the key — USER#<id> (dashboard), API_KEY#<fingerprint> (another key), AEP#<did> (AEP grant) — an actor id: USER#<userId> (dashboard), API_KEY#<fingerprint> (another key), AEP#<did> (an enrolled agent), CLERK, SYSTEM.

scopesstring[] required

Scope grants: {resource}:{action} over runs, resources, wallet, topups, controls and api_keys with read/create/update/delete, plus {resource}:* and *. Catalog reads need no scope. Fixed at creation.

status'ACTIVE' | 'EXPIRED' | 'REVOKED' required

ACTIVE, EXPIRED (derived from expiresAt) or REVOKED. Only ACTIVE keys authenticate.

origin'DASHBOARD' | 'API' | 'AEP' | 'SYSTEM' required

Channel the key was minted through — derived from createdBy: DASHBOARD, API, AEP or SYSTEM.

expiresAtstring date-time

Expiry (ISO 8601). Absent ⇒ never expires.

revokedAtstring date-time

When the key was revoked. Present only when REVOKED.

revokedBystring

Who revoked the key (present only when REVOKED) — an actor id: USER#<userId> (dashboard), API_KEY#<fingerprint> (another key), AEP#<did> (an enrolled agent), CLERK, SYSTEM.

createdAtstring date-time required

Creation time (ISO 8601).

lastUsedAtstring date-time

Last time the key authenticated a request. Absent if never used.

Example response

{
  "label": "ci-runner",
  "keyPrefix": "monid_test_a1b2c3d4",
  "createdBy": "USER#user_2abc",
  "scopes": [
    "runs:create",
    "runs:read",
    "wallet:read"
  ],
  "revokedBy": "USER#user_2abc"
}

Changes