Contract
- shape
- collection
- authority
- read
- evidence
- none
- subscription
- false
- permission
- any one of: org.admin (carried by the caller's role template in the org `org_id`); api_key.read (carried by the caller's role template in the org `org_id`); a deactivated caller is refused first
- idempotency
- safe
- emits
- none
- MCP tool
- list_api_keys
- REST
- POST https://api.containertradehq.com/v1/cap/list_api_keys
Idempotency: a read: calling again changes nothing
Inputs
| name | type | required | validation |
|---|---|---|---|
| org_id | org_id | required | tradehq-org-id; 1 to 20 characters The org whose keys they are. |
| include_revoked | boolean | optional | Also list revoked keys. False by default. |
| limit | integer | optional | 1 to 200; default 50 The page size. |
| after | text | optional | 1 to 12 characters The previous page's next_after. |
Paginated: next next_after · ceiling not_declared
Response
items· object[]next_after· stringnull · Pass as `after` for the next page; null on the last one.
Full JSON Schema
{
"type": "object",
"properties": {
"items": {
"type": "array",
"items": {
"type": "object",
"properties": {
"key_id": {
"type": "string",
"description": "The key's id, its public part.",
"x-data-class": "operational"
},
"org_id": {
"type": "string",
"minLength": 1,
"maxLength": 20,
"pattern": "^[A-Za-z0-9_-]{1,20}$",
"format": "tradehq-org-id",
"description": "The live org it was issued on.",
"x-data-class": "operational"
},
"name": {
"type": "string",
"description": "What it is for.",
"x-data-class": "operational"
},
"service_account_id": {
"type": [
"string",
"null"
],
"description": "The service account that owns the key and that it acts as (TRA-493); null only for a BK_ key the core issued.",
"x-data-class": "operational"
},
"kind": {
"type": "string",
"enum": [
"sk",
"legacy"
],
"description": "sk for a key this plane issued, legacy for a BK_ key.",
"x-data-class": "operational"
},
"mode": {
"type": "string",
"enum": [
"live",
"test"
],
"description": "live, or test for a key that reaches the test twin.",
"x-data-class": "operational"
},
"status": {
"type": "string",
"enum": [
"active",
"expiring",
"expired",
"revoked"
],
"description": "active; expiring when it has an expiry still ahead, as a rotated key does in its overlap; expired; or revoked.",
"x-data-class": "operational"
},
"display": {
"type": "string",
"description": "The key's prefix and id, safe to show anywhere. Never the secret.",
"x-data-class": "operational"
},
"created_at": {
"type": "string",
"format": "date-time",
"description": "When it was issued.",
"x-data-class": "operational"
},
"created_by": {
"type": [
"string",
"null"
],
"minLength": 1,
"maxLength": 20,
"pattern": "^[A-Za-z0-9_-]{1,20}$",
"format": "tradehq-user-id",
"description": "Who issued it.",
"x-data-class": "operational"
},
"expires_at": {
"type": [
"string",
"null"
],
"format": "date-time",
"description": "When it stops working, if it does.",
"x-data-class": "operational"
},
"revoked_at": {
"type": [
"string",
"null"
],
"format": "date-time",
"description": "When it was revoked.",
"x-data-class": "operational"
},
"api_version": {
"type": [
"string",
"null"
],
"description": "The API version it is pinned to; null for a BK_ key, which follows the current version.",
"x-data-class": "operational"
},
"requests_per_minute": {
"type": [
"integer",
"null"
],
"description": "Its per-minute limit, or null for none.",
"x-data-class": "operational"
},
"requests_per_day": {
"type": [
"integer",
"null"
],
"description": "Its per-day limit, or null for none.",
"x-data-class": "operational"
},
"rotated_from": {
"type": [
"string",
"null"
],
"description": "The key it succeeded.",
"x-data-class": "operational"
},
"rotated_to": {
"type": [
"string",
"null"
],
"description": "The key that succeeded it.",
"x-data-class": "operational"
},
"grants": {
"type": "array",
"items": {
"type": "string"
},
"description": "What the key was granted (TRA-619), in name order: the permissions it may use, each only while its service account's role template carries it. Empty for a key granted nothing and for a BK_ key.",
"x-data-class": "operational"
}
},
"required": [
"key_id",
"org_id",
"name",
"service_account_id",
"kind",
"mode",
"status",
"display",
"created_at",
"created_by",
"expires_at",
"revoked_at",
"api_version",
"requests_per_minute",
"requests_per_day",
"rotated_from",
"rotated_to",
"grants"
],
"additionalProperties": false
}
},
"next_after": {
"type": [
"string",
"null"
],
"description": "Pass as `after` for the next page; null on the last one."
}
},
"required": [
"items",
"next_after"
],
"additionalProperties": false
} Refusals
not yet declared
The platform refusals apply to every call: version, authentication, authority, validation and rate limits, each in the same envelope.
Surfaces
DesktopF
MobileF
APIF
MCPF
VoiceD4
PushN
OneBoxN
OutboundN
- Voice: degraded: visualization
- Push: emits nothing
- OneBox: no document originates an API key
- Outbound: crosses to no counterparty
Events
None emitted.
Related
list_capability_events, list_granted_capabilities, list_reports