---
title: "Read the key builder"
method: GET
path: "/keys/builder"
tags: ["Credentials"]
---

# Read the key builder

`GET /keys/builder`

## Request

- Base URL: `https://api.primitive.dev/v1`
- URL: `https://api.primitive.dev/v1/keys/builder`
- Auth: HTTP bearer

The key presets the caller may use (each with whether it is available and why not), the permission matrix for custom keys and the policy in force. An area marked org_wide_only (Members) is listed only to a person who holds its permission, and only a custom key with no addresses or domains may hold it. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled.

Person only: a dashboard session. The person's role must hold keys:read. API keys, agent connection keys and agents are refused.

## Response `200`

Success

- object
  - `success` true, required
  - `data` CredentialsGetKeyBuilderResult, required
    - `enabled` boolean, required
    - `presets` object[], required
      - `id` string, required
      - `label` string, required
      - `description` string, required
      - `mail_reach` 'org' | 'listed' | 'chosen'
      - `available` boolean, required
      - `reason` string, nullable, required
      - `message` string, nullable, required
    - `matrix` object[], required
      - `id` string, required
      - `label` string, required
      - `description` string, required
      - `read` string[], required
      - `write` string[], required
      - `resource` string, nullable, required
      - `org_wide_only` boolean
    - `policy` object, required
      - `max_key_lifetime_days` integer, nullable, required
      - `require_key_expiry` boolean, required
      - `super_admin_key_creators` 'owners_and_admins' | 'owners', required
      - `members_may_mint_keys` boolean, required
      - `allow_org_mail_scope_keys` boolean, required
      - `cap_agents_below_person` boolean, required
      - `removal_suspends_created` boolean, required
      - `oauth_consent_admin_only` boolean, required
      - `cli_access` 'owners_admins_and_operators' | 'owners_and_admins' | 'all_members' | 'off'

## Other responses

- `400`: Invalid request parameters
- `401`: Invalid or missing API key
- `403`: Authenticated caller lacks permission for the operation
- `404`: Resource not found
- `429`: Rate limit exceeded. The `ratelimit-*` headers describe the limiter that rejected this request, with its own limit and window, not the API budget that successful responses report. A limiter that reports only a wait sends `Retry-After` alone.

---

[API](https://skmtc.dev/primitive/apis/primitive-api.md) - [All operations](https://skmtc.dev/primitive/apis/primitive-api/llms.txt) - [OpenAPI document](https://skmtc.dev/primitive/apis/primitive-api/revisions/bce409c97acb?raw)