List API keys
Keys are never returned in full — only their identity and last four. Creation stays in the console deliberately: a leaked key that can mint more keys is a leaked account.
Keys are never returned in full — only their identity and last four. Creation stays in the console deliberately: a leaked key that can mint more keys is a leaked account.
Authorization
apiKey Organization API key from the console (ak_...), or an OAuth access token with user:org:read, the organization selected during consent, and the capability required by the operation.
In: header
Query Parameters
Maximum number of resources to return.
1 <= value <= 10020Opaque cursor from the preceding page's next_cursor.
Response Body
application/json
application/json
application/json
application/json
application/json
curl -X GET "https://example.com/api_keys"{ "object": "list", "data": [ { "id": "string", "object": "api_key", "name": "string", "last4": "string", "revoked": true, "last_used_at": "2019-08-24T14:15:22Z", "created_at": "2019-08-24T14:15:22Z" } ], "has_more": true, "next_cursor": "string"}The account behind the presented credentials GET
Returns the account that owns the presented API key. This is also the identity endpoint the generated typeship CLI's `whoami` calls.
Revoke an API key DELETE
Idempotent: revoking an already-revoked key returns the same body, so a rotation script that re-runs does not have to special-case having already succeeded. An OAuth member may revoke a key they created; an organization admin may revoke any key. Organization API keys retain account-wide authority.