---
title: "Retrieve a management key"
method: GET
path: "/v2/management-keys/{management_key_id}"
tags: ["Management keys"]
---

# Retrieve a management key

`GET /v2/management-keys/{management_key_id}`

## Request

- Base URL: `https://my.orq.ai`
- URL: `https://my.orq.ai/v2/management-keys/{management_key_id}`
- Auth: HTTP bearer

Retrieves the metadata for an existing management key by its unique identifier. The raw secret is never returned — only `token_prefix`, `permission_mode`, and lifecycle fields.

## Path parameters

- `management_key_id` string, required

## Response `200`

OK

- GetManagementKeyResponse
  - `management_key` ManagementKey, required: ManagementKey defines permissions, expiration, and revocation for a management key. Management keys are always workspace-scoped — there is no project_scope field, and they have no per-user owner (every management key is workspace-owned; `created_by_id` records who created it).
    - `management_key_id` string, required: Canonical key identifier (ULID). Embedded in opaque tokens as `sk-orq-<id>-<secret>`.
    - `name` string, required: Human-readable name shown in the dashboard.
    - `permission_mode` 'MANAGEMENT_PERMISSION_MODE_ALL' | 'MANAGEMENT_PERMISSION_MODE_RESTRICTED' | 'MANAGEMENT_PERMISSION_MODE_READ_ONLY', required
    - `access` object: Per-domain access map. Only populated when `permission_mode` is `MANAGEMENT_PERMISSION_MODE_RESTRICTED`. The authoritative list of valid keys (Domain.id values) is returned by the List management capability catalog endpoint (GET /v2/management-keys/capabilities).
    - `token_prefix` string, required: Displayable prefix for UI listings (e.g. "sk-orq-01HXY..."). Safe to expose.
    - `status` 'MANAGEMENT_KEY_STATUS_ACTIVE' | 'MANAGEMENT_KEY_STATUS_DISABLED' | 'MANAGEMENT_KEY_STATUS_REVOKED', required
    - `created_by_id` string: Audit: user who created the key.
    - `updated_by_id` string: Audit: user who last updated the key.
    - `created_at` string, date-time, required: Time the key was created.
    - `updated_at` string, date-time, required: Time the key was last updated.
    - `last_used_at` string, date-time: Last authenticated use.
    - `expires_at` string, date-time: Optional expiration. Keys whose `expires_at` is in the past are rejected when used. Unset means the key never expires.

## Other responses

- `401`: Authentication required. See https://docs.orq.ai/reference/errors for the error codes.
- `403`: Not permitted for this key, project or workspace. See https://docs.orq.ai/reference/errors for the error codes.

## Changes

> 554 revisions in range; 71 not diffed.

- **2026-10-23** `0b4e519a544f`: 4 info
  - added the non-success response with the status `401`
  - added the non-success response with the status `403`
  - removed the `MANAGEMENT_KEY_STATUS_UNSPECIFIED` enum value from the `management_key/allOf[#/components/schemas/ManagementKey]/status` response property for the response status `200`
  - removed the `MANAGEMENT_PERMISSION_MODE_UNSPECIFIED` enum value from the `management_key/allOf[#/components/schemas/ManagementKey]/permission_mode` response property for the response status `200`
- **2026-10-23** `732aed62833a`: 2 warning, 2 info
  - added the new `MANAGEMENT_KEY_STATUS_UNSPECIFIED` enum value to the `management_key/allOf[#/components/schemas/ManagementKey]/status` response property for the response status `200`
  - added the new `MANAGEMENT_PERMISSION_MODE_UNSPECIFIED` enum value to the `management_key/allOf[#/components/schemas/ManagementKey]/permission_mode` response property for the response status `200`
  - removed the non-success response with the status `401`
  - removed the non-success response with the status `403`
- …earlier changes not shown

[Operation history](https://skmtc.dev/orq-ai/apis/orq-ai-api/changes/v2/management-keys/:management_key_id/get.md)

---

[API](https://skmtc.dev/orq-ai/apis/orq-ai-api.md) - [All operations](https://skmtc.dev/orq-ai/apis/orq-ai-api/llms.txt) - [OpenAPI document](https://skmtc.dev/orq-ai/apis/orq-ai-api/revisions/928a71e92252?raw)