---
title: "List Keys"
method: GET
path: "/api/v1/organizations/{organization_id}/keys"
tags: ["organization"]
---

# List Keys

`GET /api/v1/organizations/{organization_id}/keys`

## Request

- Base URL: `https://ndi-api.nace.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://ndi-api.nace.ai/api/v1/organizations/{organization_id}/keys`
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/nace/apis/ndi-service/docs/api/v1/organizations/:organization_id/keys/get.ts> (a function with typed inputs; its response is checked against the schema)

List the organization's keys (metadata only — secrets are unrecoverable).

Expired keys are listed with ``status: "expired"`` so an owner can see why an
integration stopped working and replace the key; disabled ones with
``status: "disabled"``.

The caller's own console session key is included with ``system: true``. Other
members' console keys are not listed at all.

## Path parameters

- `organization_id` string, uuid, required: Organization from POST /console/session.

## Response `200`

Successful Response

- OrganizationKeyListResponse
  - `keys` OrganizationKeyInfo[], required
    - `key_prefix` string, required: Display handle, and the id used to revoke or grant.
    - `name` string, required
    - `description` string, nullable: What the key is for, as its creator described it. Null when they said nothing.
    - `created_by_user_id` string, uuid, nullable: Who minted it. Attribution only — the key belongs to the organization.
    - `created_at` string, date-time, required
    - `expires_at` string, date-time, nullable: When it stops authenticating. Null means it never expires.
    - `status` 'active' | 'expiring_soon' | 'expired' | 'disabled', required: 'expiring_soon' inside the warning window before expires_at; 'expired' after it; 'disabled' when an admin has suspended it, which outranks both. An expired or disabled key stays listed so it can be seen and replaced, but it no longer authenticates.
    - `disabled` boolean: Whether an admin has suspended the key. Unlike revocation this is reversible.
    - `system` boolean: A key the platform manages — the signed-in member's own console session key. It is listed so the credential the console itself uses is visible, but it cannot be disabled or revoked through these endpoints.
    - `last_used_at` string, date-time, nullable: Last authenticated use. May lag by up to the auth-cache TTL (~5 minutes): cache hits skip the timestamp bump.

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `402`: Payment Required
- `403`: The account is disabled, or the caller's role does not permit this.
- `404`: No console account yet, or no membership in this organization.
- `409`: Conflict
- `413`: Request Entity Too Large
- `422`: Unprocessable Entity
- `500`: Internal Server Error
- `503`: Service Unavailable

---

[API](https://skmtc.dev/nace/apis/ndi-service.md) - [All operations](https://skmtc.dev/nace/apis/ndi-service/llms.txt) - [OpenAPI document](https://skmtc.dev/nace/apis/ndi-service/revisions/d9d1f8ec2207?raw)