---
title: "List developer API keys"
method: GET
path: "/api/settings/developer/api-keys"
tags: ["API keys"]
---

# List developer API keys

`GET /api/settings/developer/api-keys`

## Request

- Base URL: `https://api.setluca.com`
- URL: `https://api.setluca.com/api/settings/developer/api-keys`
- Auth: API key in cookie `luca.session_token`

Every key in the organization the caller is allowed to see. You also get the workspaces they can mint keys for, the scopes on offer, and whether they can manage keys at all. A member with narrow workspace access only sees keys confined to workspaces they can read. Key material never comes back here.

**Session-only.** This endpoint isn't on the API-key allowlist. An organization API key gets a 403 here, whatever scopes it holds.

## Headers

- `Luca-API-Version` '1'

## Response `200`

ok

- DeveloperApiKeysResponse
  - `apiKeys` object[], required
    - `id` string, required
    - `name` string, nullable, required
    - `prefix` string, nullable, required
    - `start` string, nullable, required
    - `scopes` string[], required
    - `capabilityTier` 'read' | 'draft' | 'queue_ops' | 'full', required
    - `dataSensitivityTier` 'redacted' | 'full_content', required
    - `workspaceIds` string[], required
    - `workspaceMode` 'current' | 'selected' | 'all', required
    - `createdByUserId` string, nullable, required
    - `rateLimitEnabled` boolean, required
    - `rateLimitMax` integer, nullable, required
    - `rateLimitTimeWindow` integer, nullable, required
    - `remaining` integer, nullable, required
    - `lastUsedAt` string, nullable, required
    - `expiresAt` string, nullable, required
    - `revokedAt` string, nullable, required
    - `status` 'active' | 'expired' | 'revoked', required
    - `createdAt` string, required
    - `updatedAt` string, required
  - `workspaces` object[], required
    - `id` string, uuid, required
    - `slug` string, required
    - `name` string, required
  - `availableScopes` string[], required
  - `canManageApiKeys` boolean, required

## Other responses

- `401`: unauthorized
- `429`: rate limited
- `500`: internal error
- `503`: service unavailable

---

[API](https://skmtc.dev/setluca/apis/luca-api.md) · [All operations](https://skmtc.dev/setluca/apis/luca-api/llms.txt) · [OpenAPI document](https://skmtc.dev/setluca/apis/luca-api/revisions/90a200e4100b?raw)