Read an API key
GET /v1/api-keys/{key_id}
| Property | Value |
|---|---|
| Operation | get_api_key |
| Group | API keys |
| Scope | api_keys:read |
| Route class | read |
| Idempotency | No Idempotency-Key |
| Audit | Not audited: A configuration read: a key is answered by its prefix, never its secret, and no read of it is Call content. |
| Released in | 1.51.0 |
| Phase 0 host | Served (the hosted api pins 1.65.0) |
Answers one key of the Organization by its prefix, never the secret (1.51.0). A developer manages test keys only (access-control-and-isolation.md section 4.2), so its reads answer test keys only and a live key of the Organization is not_found to it. Session only (api.md section 2): the api refuses the route to every API key with forbidden, whatever its scopes; Phase 0 accepts a Member ID token.
Request
Set VOCAL_API to the base URL of your API and VOCAL_API_KEY to an API key with the api_keys:read scope (Authentication and keys). Replace each placeholder, such as agt_... or <name>, with your own value.
curl "$VOCAL_API/v1/api-keys/key_..." \
-H "Authorization: Bearer $VOCAL_API_KEY"const response = await fetch(`${process.env.VOCAL_API}/v1/api-keys/key_...`, {
headers: {
Authorization: `Bearer ${process.env.VOCAL_API_KEY}`,
},
});
console.log(response.status, await response.text());import os
import requests
response = requests.get(
f"{os.environ['VOCAL_API']}/v1/api-keys/key_...",
headers={
"Authorization": f"Bearer {os.environ['VOCAL_API_KEY']}",
},
)
print(response.status_code, response.text)Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
key_id | path | ApiKeyId | yes | The id of an API key: key_ and the row's UUIDv7 in 26 Crockford base32 characters. Opaque and safe to log. |
Responses
| Status | Content type | Shape | Error codes |
|---|---|---|---|
200 | application/json | ApiKey | |
400 | application/json | ErrorEnvelope | invalid_request |
401 | application/json | ErrorEnvelope | unauthenticated |
403 | application/json | ErrorEnvelope | forbidden |
404 | application/json | ErrorEnvelope | not_found |
429 | application/json | ErrorEnvelope | rate_limited |
500 | application/json | ErrorEnvelope | internal_error |
Fields of the 200 answer
The shape is ApiKey.
| Field | Type | Required | Description |
|---|---|---|---|
created_at | Timestamp | yes | |
created_by | ActorRef or null | no | Who made the key (1.52.0): {type: member, id} for a key created through POST /v1/api-keys, {type: operator, id} for one the seed or an operator command made when the api records it, and null when it does not. Absent from an api before 1.52.0. A removed Member keeps its id here; the keys it made stay. |
environment | Environment | yes | |
expires_at | Timestamp or null | yes | |
id | ApiKeyId | yes | |
last_used_at | Timestamp or null | yes | |
name | string | yes | |
object | "api_key" | yes | |
prefix | string | yes | The non-secret start of the key, vk_<env>_<lookup>; the full key is vk_<env>_<lookup>_<secret>. |
revoked_at | Timestamp or null | yes | |
scopes | array of ApiKeyScope | yes | |
status | ApiKeyStatus | yes |