---
title: "What one of your API keys did"
method: GET
path: "/management-console/account/api-keys/{id}/activity.json"
tags: ["Your account"]
---

# What one of your API keys did

`GET /management-console/account/api-keys/{id}/activity.json`

## Request

- Base URL: `https://verifiedhandles.org`
- URL: `https://verifiedhandles.org/management-console/account/api-keys/{id}/activity.json`
- Auth: HTTP bearer

Every change made with one of your keys (the audit log’s rows that name it), newest first, 50 a page. Changes, not reads: reading writes no row. Page with `before` (the `next` of the page before) and back with `after` (`prev`). Only your own keys: any other id is a 404, whoever holds it. No other capability is needed.

## Path parameters

- `id` string, required

## Query parameters

- `before` string
- `after` string

## Response `200`

The key and a page of its rows.

- object
  - `key` object, required
    - `id` string, required
    - `name` string, required
    - `prefix` string, required
    - `state` 'live' | 'revoked' | 'expired', required
  - `rows` KeyActivityRow[], required
    - `id` string, required: The audit row’s id: pass it as `before` or `after` to page.
    - `ts` string, date-time, required
    - `label` string, required: The action in words.
    - `sentence` string, required: The row in one sentence, with names rather than ids.
    - `surface` string, nullable, required: What it came through: `api` (the key itself) or `mcp` (an MCP tool with it).
    - `mcp_tool` string, nullable, required: The MCP tool that made it, if one did.
    - `ip` string, nullable, required: The IP address it came from, only where the row is your own act; erased a year after it was recorded.
    - `client` string, nullable, required: The client in plain words (“curl”, “Claude Code”), from its user agent.
  - `next` string, nullable, required: Pass as `before` for older rows; null on the last page.
  - `prev` string, nullable, required: Pass as `after` for newer rows; null on the first page.

## Other responses

- `302`: No key was sent: the console sends a browser to sign in. A script should send its key.
- `400`: The request sent a key and a session cookie together (`bearer_with_cookie`): send one.
- `401`: The key was refused: unknown, revoked or expired, its holder may no longer use keys, or this instance takes none. Carries `WWW-Authenticate: Bearer`.
- `403`: The key’s account lacks the capability, or is blocked: the body is the word `Forbidden`.
- `404`: Not one of your keys.
- `503`: The site is down for maintenance. The body is the maintenance page, as HTML. Try again later: `Retry-After` gives the seconds.

---

[API](https://skmtc.dev/verifiedhandles/apis/verified-handles-api.md) · [All operations](https://skmtc.dev/verifiedhandles/apis/verified-handles-api/llms.txt) · [OpenAPI document](https://skmtc.dev/verifiedhandles/apis/verified-handles-api/revisions/40720de2e0ec?raw)