Lists readable root keys in the authenticated workspace, ordered by key ID. Requires unkey:v1:<workspace_id>:rootKeys/<key_id>#read for each returned key. Use rootKeys/*#read to read all root keys. Write permission does not imply read. A caller with no readable keys receives an empty page.

Includes disabled and expired keys from the new root-key store. Deleted keys are excluded. Secrets and hashes are never returned. Pass the returned cursor when hasMore is true to retrieve the next page.

{
  "meta": {
    "requestId": "req_123"
  },
  "pagination": {
    "cursor": "eyJrZXkiOiJrZXlfMTIzNCIsInRzIjoxNjk5Mzc4ODAwfQ==",
    "hasMore": true
  }
}