---
title: "List who an API key is shared with"
method: GET
path: "/api-keys/{id}/shares"
tags: ["Account"]
---

# List who an API key is shared with

`GET /api-keys/{id}/shares`

## Request

- Base URL: `https://api.varg.ai/v2`
- URL: `https://api.varg.ai/v2/api-keys/{id}/shares`
- Auth: HTTP bearer

The key's owner and the people it is shared with. Only the key's owner
(or a manager of the owning team) can list; people the key is shared
with get 404. Requires an app session (Supabase JWT), not an API key.

## Path parameters

- `id` string, uuid, required

## Response `200`

Owner and shares

- ApiKeyShares
  - `owner` ApiKeyPerson
    - `user_id` string, uuid
    - `email` string, nullable
    - `display_name` string, nullable
    - `avatar_url` string, nullable
  - `shares` ApiKeyShare[]
    - `user_id` string, uuid
    - `email` string, nullable
    - `display_name` string, nullable
    - `avatar_url` string, nullable
    - `shared_at` string, date-time

## Other responses

- `401`: Missing or invalid API key / JWT
- `403`: Only app sessions can manage API keys (API keys and connected applications are rejected)
- `404`: Unknown API key, or you have no access to it

## Changes

- **2026-10-20** `43bcf5ea398d`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/varg/apis/varg-api/changes/api-keys/:id/shares/get.md)

---

[API](https://skmtc.dev/varg/apis/varg-api.md) · [All operations](https://skmtc.dev/varg/apis/varg-api/llms.txt) · [OpenAPI document](https://skmtc.dev/varg/apis/varg-api/revisions/09d49a6d852f?raw)