Skip to content
VPNDetection

List

get/api/v1/iam/apikeys

Each key's metadata. A list never carries a secret, here or in the console: reveal reads one.

retrievable says whether the secret could still be read back at all. A key issued before this product stored secrets recoverably was never kept, so reveal will refuse it permanently; rotating produces one that can be read.

Authorization

bearerAuthbearer token

Authorization: Bearer <key>.

Scopes: apikeys.read

Responses

200application/json

The organization's keys, newest first.

rcrequiredstring
keysrequiredarray<object>
idrequiredstring (uuid)
namerequiredstring
key_prefixrequiredstring

The leading, non-secret part, so a key is recognizable without storing it.

createdrequiredstring (date-time)
expiresstring (date-time)
last_used_atstring (date-time)
revoked_atstring (date-time)
allowed_cidrsarray<string>

Source-IP allowlist. EMPTY MEANS UNRESTRICTED, not deny-all.

allowed_scopesarray<string>
retrievableboolean

Whether this key's secret can still be read back. False permanently for a key issued before secrets were stored recoverably.

TypeScript type
ts
{
  rc: string;
  keys: ({
    id: string;
    name: string;
    key_prefix: string;
    created: string;
    expires?: string | null;
    last_used_at?: string | null;
    revoked_at?: string | null;
    allowed_cidrs?: string[];
    allowed_scopes?: string[];
    retrievable?: boolean;
  })[];
}
401application/json

No credential was presented, or it is not valid.

rcrequiredstring

The outcome. SUCCESS on success; otherwise the reason.

TypeScript type
ts
{
  rc: string;
}
403application/json

The credential does not hold the scope this endpoint requires. The missing scope is deliberately not named.

rcrequiredstring

The outcome. SUCCESS on success; otherwise the reason.

TypeScript type
ts
{
  rc: string;
}