---
title: "List a service account's API keys."
method: GET
path: "/organizations/{organizationId}/service-accounts/{serviceAccountId}/keys"
tags: ["service-accounts"]
---

# List a service account's API keys.

`GET /organizations/{organizationId}/service-accounts/{serviceAccountId}/keys`

## Request

- Base URL: `https://api.shorebird.dev/api/v1`
- URL: `https://api.shorebird.dev/api/v1/organizations/{organizationId}/service-accounts/{serviceAccountId}/keys`
- Auth: one of:
  - HTTP bearer
  - HTTP bearer

The service account's keys that have not been revoked, newest first.
Keys past their `expires_at` are still listed until revoked. A key's
secret is never returned here: it is shown once, when the key is
issued.

Requires the `serviceAccountKeys.view` permission, which only the
`admin` and `owner` roles hold.

## Query parameters

- `per_page` integer
- `cursor` string
- `page` integer

## Response `200`

The service account's unrevoked keys.

- GetServiceAccountKeysResponse: The response body for GET /organizations/{organizationId}/service-accounts/{serviceAccountId}/keys.
  - `keys` ServiceAccountKey[], required: The service account's unrevoked keys, newest first.
    - `id` integer, required: The key's ID.
    - `name` string, required: The key's name.
    - `created_at` string, date-time, required: When the key was issued.
    - `last_used_at` string, date-time, nullable, required: When the key was last used, or null if it never has been.
    - `expires_at` string, date-time, nullable, required: When the key expires, or null if it never does.
    - `scopes` string[], required: The key's scopes by wire name. A service account's key is issued with `api` and does what the account's role allows.
  - `next_cursor` string: The opaque cursor of the next page; send it back as `cursor` to get that page. Present only when the request was paginated (sent `per_page`, `cursor` or `page`) and another page follows. Absent on the last page and on unpaginated responses.
  - `total_count` integer: How many items the whole list holds. Present only when the request was paginated.

## Other responses

- `400`: The organization id (`organization_id_malformed`) or the service account id (`service_account_bad_request`) is not an integer.
- `403`: The caller lacks the `serviceAccountKeys.view` permission.
- `404`: No such organization or the caller is not a member of it (`organization_membership_guard_error`), or the organization has no service account with that id (`service_account_not_found`).
- `424`: A database read failed (`service_account_database_error`).
- `default`: Standard error response. Emitted for any non-2xx status where a body can be decoded into an [ErrorResponse].

---

[API](https://skmtc.dev/shorebird/apis/shorebird-codepush-api.md) - [All operations](https://skmtc.dev/shorebird/apis/shorebird-codepush-api/llms.txt) - [OpenAPI document](https://skmtc.dev/shorebird/apis/shorebird-codepush-api/revisions/941da8871d10?raw)