List API keys
GET/api-keys
Returns the registered API keys, including revoked ones (check isRevoked).
The key value itself (the JWT) is never returned after creation. The list is paged and supports sort and inlinePageInfo. You can also filter by any field of the record with an equality query parameter, for example ?appName=reporting-integration or ?isRevoked=true. An unknown field name returns 400 InvalidQuery. advanced is ignored here, and select is rejected with 400 InvalidQuery.
Required role: superadmin or admin.
Request
Responses
- 200
- 400
- 401
- 403
A page of API keys.
Response Headers
Number of records in this page.
Page size used for the request (limit).
Current page number.
Total number of pages.
Total number of records matching the query.
RFC 8288 links with rel values first, last, and, when they exist, prev and next.
A query parameter is not a field of the record, or select was sent (field "select": field name or value not allowed), or a key in the query starts with $.
No token, or the token is invalid or expired. The body is {message}: No auth token provided when no token is sent, otherwise the token check's message (jwt expired, jwt malformed, invalid signature, invalid token, jwt signature is required). Send Authorization: Bearer <token> exactly: the server drops the first seven characters of the header and reads the rest as the token, so a different scheme or an extra space fails. If Authorization is absent, the server reads a token field in the body, then a token query parameter, then x-access-token. Routes that validate query fields reject ?token= with 400 InvalidQuery.
The token's role is not allowed for this operation, or the token's scopes exclude the route
(Scope not allowed by token).