Rate limit: 15 requests per second

Lists every API key of the organisation of the requesting API key. The key value, its permissions and its scopes are never returned.

Deleted keys are listed too, with deleted_at set. Keys are hard-deleted after the retention window, so an old created_by.id may no longer resolve to a key in this list.

An API key restricted to some accounts still lists every key of its organisation.

Required permission: api_keys.view

{
  "items": [
    {
      "id": "3",
      "comment": "CRM sync",
      "last_four_chars": "a1b2"
    }
  ]
}