---
title: "Get an API key"
method: GET
path: "/v2/api_keys/{api_key_id}"
tags: ["API Keys"]
---

# Get an API key

`GET /v2/api_keys/{api_key_id}`

Returns an API key. The response shows the corpora the key can access and with what permissions.

Users that hold none of the `corpus_administrator`, `administrator`, or `owner` roles can only get their own personal API key; a key that exists but belongs to another user returns a `404` error. Machine credentials — API keys, app clients, and service accounts — without one of those three roles cannot call this operation.

## Path parameters

- `api_key_id` string, required

## Headers

- `Request-Timeout` integer
- `Request-Timeout-Millis` integer

## Response `200`

The response includes the API key name, enabled status, API key role, and API policy.

- ApiKey — An API key used to authenticate and authorize requests to the Vectara platform.
  - `id` string, required — The ID of the API key.
  - `name` string, required — The human-readable name of the API key.
  - `secret_key` string, required — The key used in API requests. Keep the key secure.
  - `enabled` boolean — Indicates whether the API key is enabled.
  - `api_roles` ApiRole[] — Customer-level roles for this API key.
  - `api_key_role` 'serving' | 'serving_and_indexing' | 'personal' — The role of the API key. A `personal` key has the same permissions as its owner. A `serving` API key can only perform query type requests on its corpora, and a `serving_and_indexing` key can perform both indexing and query type requests; these two roles are deprecated for creation — assign roles with `api_roles` instead.
  - `corpus_roles` CorpusRole[] — Corpus-specific role assignments for this API key.
    - `corpus_key` string, required — The key of the corpus this role applies to.
    - `role` 'owner' | 'administrator' | 'viewer' | 'editor', required — The role assigned for this specific corpus.
  - `agent_roles` AgentRole[] — Agent-specific role assignments for this API key.
    - `agent_key` string, required — The key of the agent this role applies to. For the `agent_end_user` role this is an agent alias key, which shares the same shape.
    - `role` 'agent_administrator' | 'agent_viewer' | 'agent_developer' | 'agent_user' | 'agent_end_user', required — The role assigned for this specific agent. * `agent_administrator` - Full administrative access to the agent including deletion and configuration. * `agent_viewer` - Read-only access to view agent configuration, sessions, events, instructions, and tools. * `agent_developer` - Can modify agent configuration, create/manage sessions, update tools and instructions. * `agent_user` - Limited access to interact with the agent by creating sessions and sending inputs. Cannot view agent configuration or modify settings. * `agent_end_user` - Granted on an alias, lets a user create sessions and send messages through it. They see only their own sessions, and within them only their own messages and the agent's replies.
  - `api_policy` ApiPolicy — The actions a principal can take on the Vectara platform.
    - `name` string, required — The name of the API role.
    - `allowed_operations` object, required — The operations the API role allows. Each operation may allow only certain resources, described by a map of resource path to resource values. If the value is null, the operation allows any resource.

## Other responses

- `403` — The caller's roles do not allow getting API keys. A machine credential — an API key, app client, or service account — that holds none of the `corpus_administrator`, `administrator`, or `owner` roles is always refused.
- `404` — No API key with this ID is visible to the caller.

## Changes

- **2026-09-14** `c94fd099d78b` — 1 warning
  - added the new `metrics_viewer` enum value to the `api_roles/items/` response property for the response status `200`
- **2026-08-08** `e85040b266cc` — 1 breaking, 6 info
  - the `api_key_role` response's property type changed from `string` to no type for status `200`
  - added the non-success response with the status `404`
  - added `#/components/schemas/ApiKeyRole` to the `api_key_role` response property `allOf` list for the response status `200`
  - removed the `personal` enum value from the `api_key_role` response property for the response status `200`
  - …3 more
- **2026-08-05** `fca567a46b3a` — 1 warning
  - added the new `agent_end_user` enum value to the `agent_roles/items/role` response property for the response status `200`

[Change history](https://skmtc.dev/vectara/apis/vectara-rest-api-v2/changes/v2/api_keys/:api_key_id/get.md)

---

[API](https://skmtc.dev/vectara/apis/vectara-rest-api-v2.md) · [All operations](https://skmtc.dev/vectara/apis/vectara-rest-api-v2/llms.txt) · [OpenAPI document](https://skmtc.dev/vectara/apis/vectara-rest-api-v2/revisions/4557c44ba062?raw)