---
title: "List every credential"
method: GET
path: "/credentials"
tags: ["Credentials"]
---

# List every credential

`GET /credentials`

## Request

- Base URL: `https://api.primitive.dev/v1`
- URL: `https://api.primitive.dev/v1/credentials`
- Auth: HTTP bearer

Every credential that can act in the organization: API keys, Function keys, agent connection keys, connected apps (OAuth), agent delegates and, where enabled, CLI logins. Secrets are never returned. Filter with kind. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled.

Person only: a dashboard session. The person's role must hold credentials:read. API keys, agent connection keys and agents are refused.

## Query parameters

- `kind` 'org_key' | 'function_key' | 'connected_key' | 'oauth' | 'agent_delegate' | 'cli_user_access'

## Response `200`

Success

- object
  - `success` true, required
  - `data` CredentialsListCredentialsResult, required
    - `items` object[], required
      - `kind` 'org_key' | 'function_key' | 'connected_key' | 'oauth' | 'agent_delegate' | 'cli_user_access', required
      - `id` string, required
      - `name` string, nullable, required
      - `prefix` string, nullable, required
      - `client` object, nullable, required
        - `client_id` string, required
        - `name` string, nullable, required
      - `grant` object, required
        - `ref` string, nullable, required
        - `type` 'template' | 'concrete' | 'computed', required
        - `template` string, nullable, required
        - `permissions` string[], nullable, required
        - `mail_scope` unknown, required
        - `resources` unknown, required
      - `creator` object, required
        - `kind` string, nullable, required
        - `id` string, nullable, required
        - `email` string, nullable, required
        - `name` string, nullable
        - `status` 'member' | 'departed' | 'unknown' | 'agent_before_claim' | 'system', required
      - `created_at` string, date-time, nullable, required
      - `last_used_at` string, date-time, nullable, required
      - `last_used_ip` string, nullable, required
      - `expires_at` string, date-time, nullable, required
      - `conditions` object, nullable, required
        - `ip_allowlist` string[], nullable, required
        - `rate_limit_per_minute` number, nullable, required
        - `suspended_at` string, date-time, nullable, required
      - `flags` string[], required
      - `actions` string[], required
      - `belongs_to` object
        - `function` object, nullable, required
          - `id` string, required
          - `name` string, nullable, required
        - `agent_address` string, nullable, required
        - `person` object, nullable, required
          - `id` string, required
          - `email` string, nullable, required
          - `name` string, nullable
    - `counts` object, required

## Other responses

- `400`: Invalid request parameters
- `401`: Invalid or missing API key
- `403`: Authenticated caller lacks permission for the operation
- `404`: Resource not found
- `429`: Rate limit exceeded. The `ratelimit-*` headers describe the limiter that rejected this request, with its own limit and window, not the API budget that successful responses report. A limiter that reports only a wait sends `Retry-After` alone.

---

[API](https://skmtc.dev/primitive/apis/primitive-api.md) - [All operations](https://skmtc.dev/primitive/apis/primitive-api/llms.txt) - [OpenAPI document](https://skmtc.dev/primitive/apis/primitive-api/revisions/bce409c97acb?raw)