---
title: "List operator keys for the caller in the active workspace (no raw tokens)"
method: GET
path: "/operator-tokens"
tags: ["Setup · Operator tokens"]
---

# List operator keys for the caller in the active workspace (no raw tokens)

`GET /operator-tokens`

## Request

- Base URL: `https://api.ziggsai.com`
- URL: `https://api.ziggsai.com/operator-tokens`
- Auth: HTTP bearer

## Response `200`

- OperatorKeysListResponseSchema
  - `keys` OperatorKeyListEntrySchema[], required
    - `keyId` string, required
    - `label` string
    - `scopes` string[], required
    - `createdAt` string, date-time, required
    - `revokedAt` string, date-time, nullable, required
    - `lastUsedAt` string, date-time, nullable, required
    - `issuedByKeyId` string, nullable, required: The key that minted this one, when it was derived from another key.
    - `boundAgentId` string, nullable, required: The agent this key always acts as. Such a key carries no scopes: what the agent may do is decided per call by the route and the grants it holds.
    - `orgId` string, nullable, required
    - `issuedVia` 'signup' | 'session' | 'derived' | 'agent_provisioning' | 'mcp_oauth' | 'device_code', nullable, required: How this key was authorized: at registration, by you in a signed-in session, derived from another key, by agent provisioning, or through one of the two assistant consent flows. It is the field that answers "I do not recognise this key, where did it come from?": a key an assistant minted is otherwise indistinguishable from one you minted yourself. Null on keys issued before this was recorded. It says how the key was minted, never what it may do.

---

[API](https://skmtc.dev/ziggsai/apis/ziggs-developer-api.md) · [All operations](https://skmtc.dev/ziggsai/apis/ziggs-developer-api/llms.txt) · [OpenAPI document](https://skmtc.dev/ziggsai/apis/ziggs-developer-api/revisions/eda79030e072?raw)