---
title: "List a user's API keys."
method: GET
path: "/api/users/{username}/api-keys"
tags: ["API Keys"]
---

# List a user's API keys.

`GET /api/users/{username}/api-keys`

## Request

- Base URL: `/` (relative, and the document was published on a file host, not at the API’s origin)
- URL: `/api/users/{username}/api-keys`
- Auth: HTTP bearer

Lists the named user's active keys, oldest first, with the total. session=true lists only session keys and session=false only long-lived keys. Requires an administrator as well as the scope. Requires the `api-keys:read` scope.

## Path parameters

- `username` string, required

## Query parameters

- `sort` string
- `order` string
- `offset` integer
- `limit` integer
- `session` boolean

## Headers

- `Authorization` string, required

## Response `200`

A page of keys.

- GetApiKeysResponse
  - `apiKeys` ApiKeyResponse[]
    - `bootstrap` boolean
    - `clientAddress` string: Session keys only: the address of the client that signed in, so a person can tell their sessions apart. Null for a long-lived key.
    - `created` string, date-time
    - `current` boolean: Whether this is the key making the request.
    - `expiresAt` string, date-time: Session keys only: when the key's maximum lifetime ends. Null for a long-lived key.
    - `id` string
    - `idleExpiresAt` string, date-time: Session keys only: when the key expires unless it is used first. Null for a long-lived key.
    - `lastUsedAt` string, date-time: Session keys only: when the key was last used. Null for a long-lived key.
    - `prefix` string
    - `scopes` string[]
    - `session` boolean: Whether this is a session key, issued when a person signed in, rather than a long-lived key.
    - `userAgent` string: Session keys only: the user agent of the client that signed in, such as a browser. Null for a long-lived key, or when the client sent none.
  - `total` integer

## Other responses

- `400`: Bad Request
- `401`: The Authorization header is absent or the API key is not recognized.
- `403`: The key does not hold api-keys:read, or the caller is not an administrator.
- `404`: There is no user with that username.
- `406`: No representation matches Accept.
- `413`: Content Too Large
- `415`: Unsupported Media Type
- `500`: Internal Server Error
- `503`: Service Unavailable

## Changes

- **2026-10-10** `c4f85daa9208`: 14 info
  - added the optional property `field` to the response with the `400` status
  - added the optional property `field` to the response with the `401` status
  - added the optional property `field` to the response with the `403` status
  - added the optional property `field` to the response with the `413` status
  - …10 more
- **2026-10-10** `bcd644347f8e`: 3 info
  - added the optional property `apiKeys/items/clientAddress` to the response with the `200` status
  - added the optional property `apiKeys/items/current` to the response with the `200` status
  - added the optional property `apiKeys/items/userAgent` to the response with the `200` status
- **2026-10-10** `1e983a7188bf`: 2 info
  - added the new optional `query` request parameter `order`
  - added the new optional `query` request parameter `sort`
- **2026-10-06** `0390610d039d`: 1 info
  - added the new optional `query` request parameter `session`
- **2026-10-05** `4082c17721d8`: 6 breaking, 6 info
  - removed the media type `*/*` for the response with the status `400`
  - removed the media type `*/*` for the response with the status `401`
  - removed the media type `*/*` for the response with the status `413`
  - removed the media type `*/*` for the response with the status `415`
  - …8 more

[Operation history](https://skmtc.dev/philterd/apis/philter-api/changes/api/users/:username/api-keys/get.md)

---

[API](https://skmtc.dev/philterd/apis/philter-api.md) - [All operations](https://skmtc.dev/philterd/apis/philter-api/llms.txt) - [OpenAPI document](https://skmtc.dev/philterd/apis/philter-api/revisions/aa3d7ad1aab4?raw)