---
title: "List the API keys of the organisation"
method: GET
path: "/api/v0/api-keys"
tags: ["api-keys"]
---

# List the API keys of the organisation

`GET /api/v0/api-keys`

## Request

- Base URL: `https://omapi.onlymonster.ai`
- URL: `https://omapi.onlymonster.ai/api/v0/api-keys`
- Auth: API key in header `x-om-auth-token`

**Rate limit:** 15 requests per second

Lists every API key of the organisation of the requesting API key. The key value, its permissions and its scopes are never returned.

Deleted keys are listed too, with `deleted_at` set. Keys are hard-deleted after the retention window, so an old `created_by.id` may no longer resolve to a key in this list.

An API key restricted to some accounts still lists every key of its organisation.

**Required permission:** `api_keys.view`

## Response `200`

Default Response

- object
  - `items` object[], required
    - `id` string, required: Identifier of the API key.
    - `comment` string, required: Comment the organisation gave the API key.
    - `last_four_chars` string, required: Last four characters of the API key value.
    - `deleted_at` string, date-time, required: When the API key was deleted. `null` for an active key.

## Other responses

- `401`: The token is missing or invalid.
- `403`: The API key lacks the permission this endpoint requires, or the request is outside what the organisation or the API key can access.
- `429`: A rate limit of this API was exceeded.
- `500`: The request failed for a reason this API does not describe. Repeating it is safe.

## Changes

- **2026-11-03** `20f58411c6c5`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/onlymonster/apis/om-api-service/changes/api/v0/api-keys/get.md)

---

[API](https://skmtc.dev/onlymonster/apis/om-api-service.md) - [All operations](https://skmtc.dev/onlymonster/apis/om-api-service/llms.txt) - [OpenAPI document](https://skmtc.dev/onlymonster/apis/om-api-service/revisions/0003edb0288a?raw)