---
title: "List IAM credentials"
method: GET
path: "/v3/iam/principals/{principal_id}/credentials"
tags: ["IAM credentials"]
---

# List IAM credentials

`GET /v3/iam/principals/{principal_id}/credentials`

## Request

- Base URL: `https://api.us.nylas.com`
- URL: `https://api.us.nylas.com/v3/iam/principals/{principal_id}/credentials`
- Auth: HTTP bearer

Requires `iam.credentials.read` on an active principal bound to the authenticated organization. Authenticate with an active, unexpired IAM credential of type `api_key`. Application API keys (including legacy API keys) and provider OAuth tokens cannot authorize IAM management endpoints. Use an existing IAM credential with these permissions, or [create your first management credential in the Dashboard](/docs/v3/auth/nylas-iam/manage-principals-with-api/#create-a-management-credential-in-the-dashboard).

Never returns the credential secret.

Use next_cursor from the response as page_token on the next request. When next_cursor is absent, there are no more results.

## Query parameters

- `limit` integer
- `page_token` string

## Response `200`

OK

- object
  - `request_id` string: Request ID for troubleshooting.
  - `data` Credential[]
    - `id` string, required: Opaque credential ID.
    - `principal_id` string, required: ID of the principal that owns this credential.
    - `type` 'api_key', required: Supported IAM credential type.
    - `name` string, required: Descriptive workload name. Surrounding whitespace is removed.
    - `status` 'active' | 'disabled', required: Whether the principal or credential can authenticate.
    - `expires_at` integer, nullable, required: Expiration as an integer number of seconds since the Unix epoch (January 1, 1970 at 00:00:00 UTC). For example, `1799193600` represents January 6, 2027 at 00:00:00 UTC. Newly created credentials always have an expiration.
    - `created_at` integer, required: Unix timestamp in seconds.
    - `updated_at` integer, required: Unix timestamp in seconds.
  - `next_cursor` string: Opaque cursor. Absent on the final page. Pass as page_token.

## Other responses

- `400`: Invalid request or object quota exceeded
- `401`: Invalid, disabled, deleted, or expired authentication credential
- `403`: Missing management permission or organization binding
- `404`: Principal or credential not found in this organization
- `409`: Conflicting principal or credential state
- `429`: Too many requests

## Changes

- **2026-10-10** `fb580f0d35d2`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/nylas/apis/nylas-api/changes/v3/iam/principals/:principal_id/credentials/get.md)

---

[API](https://skmtc.dev/nylas/apis/nylas-api.md) - [All operations](https://skmtc.dev/nylas/apis/nylas-api/llms.txt) - [OpenAPI document](https://skmtc.dev/nylas/apis/nylas-api/revisions/7782a3e3ab70?raw)