---
title: "Check whether this project still depends on the retiring signing key"
method: GET
path: "/projects/v1/{project_id}/credential-status"
tags: ["Projects"]
---

# Check whether this project still depends on the retiring signing key

`GET /projects/v1/{project_id}/credential-status`

## Request

- Base URL: `https://api.run402.com`
- URL: `https://api.run402.com/projects/v1/{project_id}/credential-status`
- Auth: one of:
  - API key in header `SIGN-IN-WITH-X`
  - HTTP bearer

Machine-readable rotation status. A project's `anon_key`/`service_key` are DERIVED from the platform signing key and carry no expiry, so they persist in `.env` files and CI indefinitely; that key is being retired. `state` is `legacy` while the project still relies on them and `rotatable` once it holds individually revocable credentials. There is deliberately NO deadline: retirement is gated on conditions (every tenant migrated, 30 consecutive days of zero legacy-key use, explicit operator approval), not a date — `retirement.gated_on[]` lists them and `retirement.deadline` is always null. Requires `project.read` rather than credential-manage: knowing you should rotate is not a privileged act, and gating it harder would hide the warning from the automation that needs it. The in-band counterpart is the `X-Run402-Key-Rotation` response header on owner-facing surfaces.

## Path parameters

- `project_id` string, required

## Query parameters

- `include_revoked` boolean

## Headers

- `SIGN-IN-WITH-X` string, required

## Response `200`

Current rotation status for the project.

- object
  - `project_id` string
  - `state` 'legacy' | 'rotatable'
  - `legacy_key` string
  - `rotatable_credentials` integer
  - `credentials` object[]
  - `retirement` object
    - `gated_on` string[]
    - `deadline` string, nullable
  - `next_actions` object[]

## Other responses

- `403`: The caller lacks `project.read` on this project.

---

[API](https://skmtc.dev/run402/apis/run402-api.md) · [All operations](https://skmtc.dev/run402/apis/run402-api/llms.txt) · [OpenAPI document](https://skmtc.dev/run402/apis/run402-api/revisions/893607557f50?raw)