Skip to content
AiKYNETIX

List API keys

GET
/api/api-keys/
curl --request GET \
  --url http://localhost:8000/api/api-keys/ \
  --header 'Authorization: Bearer <token>'

Returns the active (non-revoked) API keys minted for the signed-in coach’s team, newest first. The plaintext token is NOT included — it was only returned at creation time. Available to any team member; only the team owner can create or revoke keys. Stays available on every tier (so the owner can audit / clean up after a downgrade).

Firebase scheme only — a partner aik_… key calling this gets 403; keys must not enumerate their siblings.

Authorizations

Section titled “Authorizations”

Responses

Section titled “Responses”

200

Section titled “200”
Media typeapplication/json
Array<object>
object
id
required

Key UUID — pass to DELETE /api/api-keys// to revoke.

string format: uuid
label
required

Human-readable identifier the team owner picked at creation. Useful for distinguishing keys (‘production webhook’, ‘mobile app v2’, ‘internal probe’).

string
last_used_at
required

ISO-8601 UTC of the most recent successful auth with this key. Null if never used.

string format: date-time
nullable
revoked_at
required

ISO-8601 UTC when the key was revoked. Null while the key is active.

string format: date-time
nullable
created_at
required

ISO-8601 UTC of creation.

string format: date-time
Examples
ExampleActiveKeys

Active keys

[
  [
    {
      "id": "9b1c7e2a-4d3f-4a8b-9c0d-1e2f3a4b5c6d",
      "label": "production webhook",
      "last_used_at": "2026-05-26T09:12:44Z",
      "revoked_at": null,
      "created_at": "2026-04-30T08:00:00Z"
    },
    {
      "id": "0a1b2c3d-4e5f-6071-8293-a4b5c6d7e8f9",
      "label": "mobile app v2",
      "last_used_at": null,
      "revoked_at": null,
      "created_at": "2026-05-20T14:31:00Z"
    }
  ]
]

401

Section titled “401”
Media typeapplication/json
object
detail
required

Human-readable message, or a stable machine code for the cases a client branches on. The standard envelope for 400 (validation — a field-keyed object may appear instead), 401 (missing / invalid credentials), 403 (authenticated but not permitted), and 404 (absent — cross-team records are collapsed to 404 so the API never leaks the existence of another team’s data).

string
Examplegenerated
{
  "detail": "example"
}

403

Section titled “403”
Media typeapplication/json
object
detail
required

Human-readable message, or a stable machine code for the cases a client branches on. The standard envelope for 400 (validation — a field-keyed object may appear instead), 401 (missing / invalid credentials), 403 (authenticated but not permitted), and 404 (absent — cross-team records are collapsed to 404 so the API never leaks the existence of another team’s data).

string
Examplegenerated
{
  "detail": "example"
}