---
title: "List API Keys"
method: GET
path: "/apiKeys"
tags: ["API Keys"]
---

# List API Keys

`GET /apiKeys`

## Request

- Base URL: `https://eu-west-1.api.silverflow.com/v1`
- URL: `https://eu-west-1.api.silverflow.com/v1/apiKeys`
- Auth: one of:
  - HTTP basic
  - HTTP bearer
- TypeScript: <https://skmtc.dev/silverflow/apis/silverflow-api/docs/apiKeys/get.ts> (a function with typed inputs; its response is checked against the schema)

This operation returns a (paged) list of all API Keys for the authenticated Agent.

Requires `apiKeys:List` permission.

## Query parameters

- `sortOrder` 'asc' | 'desc'
- `limit` integer
- `offsetToken` string

## Response `200`

A (paged) list of API Keys

- ApiKeysPage
  - `offsetToken` string
  - `moreItems` boolean
  - `apiKeys` ApiKey[], required
    - `key` string, required: Uniquely identifies an API Key
    - `status` 'disabled' | 'active' | 'archived', required: The status of an API Key
    - `agentKey` string, required: Uniquely identifies an Agent
    - `description` string
    - `permissions` Permission[], required
    - `ipRanges` IpRange[]: A list of IP ranges
    - `mtlsEnabled` boolean: Whether this API Key requires mTLS. It is `false` unless it was enabled, and it can't be set back to `false`. <a class="experimental-tag-link" href="https://docs.silverflow.com/guides/api-lifecycle#tag/EXPERIMENTAL-Tag"><span class="tag experimental-tag">EXPERIMENTAL</span></a>
    - `certificates` ApiKeyCertificate[]: The client certificates bound to this API Key. At most two can be active at the same time. <a class="experimental-tag-link" href="https://docs.silverflow.com/guides/api-lifecycle#tag/EXPERIMENTAL-Tag"><span class="tag experimental-tag">EXPERIMENTAL</span></a>
      - `certificateKey` string, required: Uniquely identifies a certificate bound to an API Key
      - `fingerprint` string, required: The SHA-256 hash of the DER-encoded certificate, as URL-safe base64 with padding (44 characters, using `-` and `_`, ending in `=`). This is the value of the `CloudFront-Viewer-Cert-Sha256` header for the certificate. To compute it from a certificate file: `openssl x509 -in cert.pem -outform der | openssl dgst -sha256 -binary | openssl base64 -A | tr '+/' '-_'`.
      - `notBefore` string, date-time, required: The start of the certificate's validity period, taken from the certificate
      - `notAfter` string, date-time, required: The end of the certificate's validity period, taken from the certificate
      - `description` string
      - `created` string, date-time, required: The date and time this object was created
      - `trustAnchorFingerprint` string, required: The SHA-256 hash of the DER-encoded certificate, as URL-safe base64 with padding (44 characters, using `-` and `_`, ending in `=`). This is the value of the `CloudFront-Viewer-Cert-Sha256` header for the certificate. To compute it from a certificate file: `openssl x509 -in cert.pem -outform der | openssl dgst -sha256 -binary | openssl base64 -A | tr '+/' '-_'`.
      - `status` 'active' | 'archived', required: The status of the certificate. Archived certificates stay in the list.
    - `secret` string: The secret part of this API Key. This value will only be returned upon creation. It cannot be changed afterwards.
    - `created` string, date-time, required: The date and time this object was created
    - `lastModified` string, date-time: The date and time this object was last modified
    - `version` integer, required: The version of this object

## Other responses

- `400`: The request was malformed. See the response body for details
- `401`: Authentication information is missing or invalid
- `403`: The authenticated client is forbidden to make the request for the resource identified.
- `429`: The number of requests (per minute) has exceeded the configured maximum

---

[API](https://skmtc.dev/silverflow/apis/silverflow-api.md) - [All operations](https://skmtc.dev/silverflow/apis/silverflow-api/llms.txt) - [OpenAPI document](https://skmtc.dev/silverflow/apis/silverflow-api/revisions/43ecbe4fd6ea?raw)