---
title: "List the calling key's user's API keys."
method: GET
path: "/api/api-keys"
tags: ["API Keys"]
---

# List the calling key's user's API keys.

`GET /api/api-keys`

## Request

- Base URL: `/` (relative, and the document was published on a file host, not at the API’s origin)
- URL: `/api/api-keys`
- Auth: HTTP bearer

Lists the active keys belonging to the calling key's user, oldest first, with the total. Returns each key's ID, prefix, scopes, creation time, and whether it is the bootstrap key, never the key itself. session=true lists only session keys and session=false only long-lived keys; total counts only the keys listed. Requires the `api-keys:read` scope.

## Query parameters

- `sort` string
- `order` string
- `offset` integer
- `limit` integer
- `session` boolean

## Headers

- `Authorization` string, required

## Response `200`

A page of keys.

- GetApiKeysResponse
  - `apiKeys` ApiKeyResponse[]
    - `bootstrap` boolean
    - `clientAddress` string: Session keys only: the address of the client that signed in, so a person can tell their sessions apart. Null for a long-lived key.
    - `created` string, date-time
    - `current` boolean: Whether this is the key making the request.
    - `expiresAt` string, date-time: Session keys only: when the key's maximum lifetime ends. Null for a long-lived key.
    - `id` string
    - `idleExpiresAt` string, date-time: Session keys only: when the key expires unless it is used first. Null for a long-lived key.
    - `lastUsedAt` string, date-time: Session keys only: when the key was last used. Null for a long-lived key.
    - `prefix` string
    - `scopes` string[]
    - `session` boolean: Whether this is a session key, issued when a person signed in, rather than a long-lived key.
    - `userAgent` string: Session keys only: the user agent of the client that signed in, such as a browser. Null for a long-lived key, or when the client sent none.
  - `total` integer

## Other responses

- `400`: Bad Request
- `401`: The Authorization header is absent or the API key is not recognized.
- `403`: The key does not hold api-keys:read.
- `404`: Not Found
- `406`: No representation matches Accept.
- `413`: Content Too Large
- `415`: Unsupported Media Type
- `500`: Internal Server Error
- `503`: Service Unavailable

## Changes

- **2026-10-10** `c4f85daa9208`: 15 info
  - added the non-success response with the status `404`
  - added the optional property `field` to the response with the `400` status
  - added the optional property `field` to the response with the `401` status
  - added the optional property `field` to the response with the `403` status
  - …11 more
- **2026-10-10** `bcd644347f8e`: 3 info
  - added the optional property `apiKeys/items/clientAddress` to the response with the `200` status
  - added the optional property `apiKeys/items/current` to the response with the `200` status
  - added the optional property `apiKeys/items/userAgent` to the response with the `200` status
- **2026-10-10** `1e983a7188bf`: 2 info
  - added the new optional `query` request parameter `order`
  - added the new optional `query` request parameter `sort`
- **2026-10-06** `0390610d039d`: 1 info
  - added the new optional `query` request parameter `session`
- **2026-10-05** `4082c17721d8`: 6 breaking, 6 info
  - removed the media type `*/*` for the response with the status `400`
  - removed the media type `*/*` for the response with the status `401`
  - removed the media type `*/*` for the response with the status `413`
  - removed the media type `*/*` for the response with the status `415`
  - …8 more

[Operation history](https://skmtc.dev/philterd/apis/philter-api/changes/api/api-keys/get.md)

---

[API](https://skmtc.dev/philterd/apis/philter-api.md) - [All operations](https://skmtc.dev/philterd/apis/philter-api/llms.txt) - [OpenAPI document](https://skmtc.dev/philterd/apis/philter-api/revisions/aa3d7ad1aab4?raw)