---
title: "List API keys"
method: GET
path: "/v1/api-keys"
tags: ["API Keys"]
---

# List API keys

`GET /v1/api-keys`

Cursor-paginated list of the workspace's API keys. Returns metadata only — the full key value is never retrievable.

## Query parameters

- `limit` integer — Max items per page (server-side cap applies).
- `cursor` string — Cursor returned by the previous page.
- `status` string — Comma-separated statuses to include (ACTIVE, EXPIRED, REVOKED). Omitted ⇒ every status except REVOKED.

## Response `200`

API keys page

- object
  - `items` ApiKey[], required
    - `label` string, required — Human-readable label. Unique per workspace.
    - `keyPrefix` string, required — Display prefix of the key (e.g. "monid_test_a1b2c3d4...").
    - `owner` string, required — User id the key belongs to (bills to, listed under). Always a user; a child key inherits its parent's owner.
    - `createdBy` string, required — Who minted the key — `USER#<id>` (dashboard), `API_KEY#<fingerprint>` (another key), `AEP#<did>` (AEP grant) — an actor id: `USER#<userId>` (dashboard), `API_KEY#<fingerprint>` (another key), `AEP#<did>` (an enrolled agent), `CLERK`, `SYSTEM`.
    - `scopes` string[], required — Scope grants: `{resource}:{action}` over runs, resources, wallet, topups, controls and api_keys with read/create/update/delete, plus `{resource}:*` and `*`. Catalog reads need no scope. Fixed at creation.
    - `status` 'ACTIVE' | 'EXPIRED' | 'REVOKED', required — ACTIVE, EXPIRED (derived from expiresAt) or REVOKED. Only ACTIVE keys authenticate.
    - `origin` 'DASHBOARD' | 'API' | 'AEP' | 'SYSTEM', required — Channel the key was minted through — derived from `createdBy`: DASHBOARD, API, AEP or SYSTEM.
    - `expiresAt` string, date-time — Expiry (ISO 8601). Absent ⇒ never expires.
    - `revokedAt` string, date-time — When the key was revoked. Present only when REVOKED.
    - `revokedBy` string — Who revoked the key (present only when REVOKED) — an actor id: `USER#<userId>` (dashboard), `API_KEY#<fingerprint>` (another key), `AEP#<did>` (an enrolled agent), `CLERK`, `SYSTEM`.
    - `createdAt` string, date-time, required — Creation time (ISO 8601).
    - `lastUsedAt` string, date-time — Last time the key authenticated a request. Absent if never used.
  - `cursor` string — Opaque cursor for the next page. Absent on the last page.

## Other responses

- `400` — Bad request — input failed validation
- `401` — Unauthorized — missing or invalid credentials
- `403` — Forbidden — caller has no workspace or no access
- `500` — Internal server error

## Changes

- **2026-09-25** `5abada71ceae` — 52 warning, 8 info
  - added the new `IDENTITY_ALREADY_LINKED` enum value to the `errorCode` response property for the response status `400`
  - added the new `IDENTITY_ALREADY_LINKED` enum value to the `errorCode` response property for the response status `401`
  - added the new `IDENTITY_ALREADY_LINKED` enum value to the `errorCode` response property for the response status `403`
  - added the new `IDENTITY_ALREADY_LINKED` enum value to the `errorCode` response property for the response status `500`
  - …56 more
- **2026-09-23** `fadab791136c` — 4 warning
  - added the new `X402_UNBOUNDED_PRICE` enum value to the `errorCode` response property for the response status `400`
  - added the new `X402_UNBOUNDED_PRICE` enum value to the `errorCode` response property for the response status `401`
  - added the new `X402_UNBOUNDED_PRICE` enum value to the `errorCode` response property for the response status `403`
  - added the new `X402_UNBOUNDED_PRICE` enum value to the `errorCode` response property for the response status `500`
- **2026-09-11** `9874d9e34fcf` — 4 info
  - added the optional property `errorCode` to the response with the `400` status
  - added the optional property `errorCode` to the response with the `401` status
  - added the optional property `errorCode` to the response with the `403` status
  - added the optional property `errorCode` to the response with the `500` status

[Change history](https://skmtc.dev/monid/apis/monid-api/changes/v1/api-keys/get.md)

---

[API](https://skmtc.dev/monid/apis/monid-api.md) · [All operations](https://skmtc.dev/monid/apis/monid-api/llms.txt) · [OpenAPI document](https://skmtc.dev/monid/apis/monid-api/revisions/99cc8f5bdff4?raw)