---
title: "Check the API key you are using"
method: GET
path: "/api-key"
tags: ["data-export"]
---

# Check the API key you are using

`GET /api-key`

## Request

- Base URL: `https://vetnio.com/api/v2`
- URL: `https://vetnio.com/api/v2/api-key`
- Auth: HTTP bearer

Returns the calling key's organization, scope, status, limits and request counts for today and the last 30 days. Use it as a first call to confirm a key works and to look up the `organizationId` for the other data-export paths. Only organization (`sk_org_…`) and workspace (`sk_ws_…`) keys are accepted: a personal API key or a browser session gets 400 `BAD_REQUEST`. The call itself counts toward the key's rate limits.

## Response `200`

The API key used for this request.

- ApiKey: The organization or workspace API key that authenticated this request, with its scope, lifecycle and usage. The secret key value is never returned.
  - `name` string, required: Label an organization admin gave the key when creating it under Organization → API. A rotated key keeps the name of the key it replaced.
  - `organizationId` string, required: Identifier of the organization the key belongs to. Use it as `{organizationId}` in the `/organizations/{organizationId}/…` paths; any other organization ID returns 403.
  - `scope` object, required: The organization or single clinic the key is limited to.
    - `type` 'organization' | 'workspace', required: What the key can reach: - `organization` — every clinic in the organization. Keys start with `sk_org_`. - `workspace` — a single clinic (workspace). Keys start with `sk_ws_` and only ever see that clinic's data.
    - `id` string, required: The organization ID when `type` is `organization`, or the workspace (clinic) ID when `type` is `workspace`.
  - `status` 'active' | 'expiring' | 'expired' | 'revoked', required: Lifecycle state of the key: - `active` — valid and has no expiry date. - `expiring` — valid until `expiresAt`. A key replaced through rotation is `expiring` during its grace period. - `expired` — `expiresAt` has passed; the key no longer authenticates. - `revoked` — an admin revoked the key; it no longer authenticates. Because expired and revoked keys are rejected with 401 before this endpoint runs, a successful response is always `active` or `expiring`.
  - `createdAt` string, required: When the key was created, as an ISO-8601 UTC timestamp.
  - `expiresAt` string, nullable, required: When the key stops working (ISO-8601 UTC), or `null` if it never expires. Rotating a key moves the old key's expiry to at most 24 hours after the rotation.
  - `lastUsedAt` string, nullable, required: Approximate time of the key's most recent authenticated request (ISO-8601 UTC), or `null` if it has not been recorded yet. Refreshed at most once every 5 minutes, so it may lag and may not include the current request.
  - `limits` object, required: Rate limits that apply to every organization and workspace key.
    - `requestsPerMinute` number, required: Maximum requests per fixed UTC minute. The next request returns 429 `TOO_MANY_REQUESTS` with the number of seconds to wait in `message`.
    - `requestsPerDay` number, required: Maximum requests per UTC day; the counter resets at 00:00 UTC. Exceeding it returns 429 until the reset.
  - `usage` object, required: Request counts recorded by the key's rate limiter.
    - `requestsToday` number, required: Requests counted for this key since 00:00 UTC today, including the current one. Every request to an endpoint the key may call is counted, even if it then fails validation or is rate limited.
    - `requestsLast30Days` number, required: Requests counted for this key over the last 30 UTC days, today included.
    - `daily` object[], required: One entry per UTC day in the last 30 days on which the key made at least one request, oldest first. Days without requests are omitted rather than returned as zero.
      - `day` string, required: UTC calendar day, formatted `YYYY-MM-DD`.
      - `requests` number, required: Requests counted for this key on that day.

## Other responses

- `400`: Invalid input data
- `401`: Authorization not provided
- `403`: Insufficient access
- `404`: Not found
- `500`: Internal server error

---

[API](https://skmtc.dev/vetnio/apis/vetnio-api.md) - [All operations](https://skmtc.dev/vetnio/apis/vetnio-api/llms.txt) - [OpenAPI document](https://skmtc.dev/vetnio/apis/vetnio-api/revisions/d004afd5617d?raw)