list_api_keys

List API keys

read collection tenant-private since 2026-10-01

Lists the org's API keys, newest first, a page at a time: each key's id and public prefix, name, mode (live or test), status (active, expiring, expired or revoked), the API version it is pinned to, its limits, and the key it was rotated from or into. Never a key's secret: Trade HQ does not keep it. Revoked keys only with include_revoked.

Contract

shape
collection
authority
read
evidence
none
subscription
false
permission
any one of: org.admin (carried by the caller's role template in the org `org_id`); api_key.read (carried by the caller's role template in the org `org_id`); a deactivated caller is refused first
idempotency
safe
emits
none
MCP tool
list_api_keys
REST
POST https://api.containertradehq.com/v1/cap/list_api_keys

Idempotency: a read: calling again changes nothing

Inputs

nametyperequiredvalidation
org_idorg_idrequiredtradehq-org-id; 1 to 20 characters
The org whose keys they are.
include_revokedbooleanoptional
Also list revoked keys. False by default.
limitintegeroptional1 to 200; default 50
The page size.
aftertextoptional1 to 12 characters
The previous page's next_after.

Paginated: next next_after · ceiling not_declared

Response

  • items · object[]
  • next_after · stringnull · Pass as `after` for the next page; null on the last one.
Full JSON Schema
{
  "type": "object",
  "properties": {
    "items": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "key_id": {
            "type": "string",
            "description": "The key's id, its public part.",
            "x-data-class": "operational"
          },
          "org_id": {
            "type": "string",
            "minLength": 1,
            "maxLength": 20,
            "pattern": "^[A-Za-z0-9_-]{1,20}$",
            "format": "tradehq-org-id",
            "description": "The live org it was issued on.",
            "x-data-class": "operational"
          },
          "name": {
            "type": "string",
            "description": "What it is for.",
            "x-data-class": "operational"
          },
          "service_account_id": {
            "type": [
              "string",
              "null"
            ],
            "description": "The service account that owns the key and that it acts as (TRA-493); null only for a BK_ key the core issued.",
            "x-data-class": "operational"
          },
          "kind": {
            "type": "string",
            "enum": [
              "sk",
              "legacy"
            ],
            "description": "sk for a key this plane issued, legacy for a BK_ key.",
            "x-data-class": "operational"
          },
          "mode": {
            "type": "string",
            "enum": [
              "live",
              "test"
            ],
            "description": "live, or test for a key that reaches the test twin.",
            "x-data-class": "operational"
          },
          "status": {
            "type": "string",
            "enum": [
              "active",
              "expiring",
              "expired",
              "revoked"
            ],
            "description": "active; expiring when it has an expiry still ahead, as a rotated key does in its overlap; expired; or revoked.",
            "x-data-class": "operational"
          },
          "display": {
            "type": "string",
            "description": "The key's prefix and id, safe to show anywhere. Never the secret.",
            "x-data-class": "operational"
          },
          "created_at": {
            "type": "string",
            "format": "date-time",
            "description": "When it was issued.",
            "x-data-class": "operational"
          },
          "created_by": {
            "type": [
              "string",
              "null"
            ],
            "minLength": 1,
            "maxLength": 20,
            "pattern": "^[A-Za-z0-9_-]{1,20}$",
            "format": "tradehq-user-id",
            "description": "Who issued it.",
            "x-data-class": "operational"
          },
          "expires_at": {
            "type": [
              "string",
              "null"
            ],
            "format": "date-time",
            "description": "When it stops working, if it does.",
            "x-data-class": "operational"
          },
          "revoked_at": {
            "type": [
              "string",
              "null"
            ],
            "format": "date-time",
            "description": "When it was revoked.",
            "x-data-class": "operational"
          },
          "api_version": {
            "type": [
              "string",
              "null"
            ],
            "description": "The API version it is pinned to; null for a BK_ key, which follows the current version.",
            "x-data-class": "operational"
          },
          "requests_per_minute": {
            "type": [
              "integer",
              "null"
            ],
            "description": "Its per-minute limit, or null for none.",
            "x-data-class": "operational"
          },
          "requests_per_day": {
            "type": [
              "integer",
              "null"
            ],
            "description": "Its per-day limit, or null for none.",
            "x-data-class": "operational"
          },
          "rotated_from": {
            "type": [
              "string",
              "null"
            ],
            "description": "The key it succeeded.",
            "x-data-class": "operational"
          },
          "rotated_to": {
            "type": [
              "string",
              "null"
            ],
            "description": "The key that succeeded it.",
            "x-data-class": "operational"
          },
          "grants": {
            "type": "array",
            "items": {
              "type": "string"
            },
            "description": "What the key was granted (TRA-619), in name order: the permissions it may use, each only while its service account's role template carries it. Empty for a key granted nothing and for a BK_ key.",
            "x-data-class": "operational"
          }
        },
        "required": [
          "key_id",
          "org_id",
          "name",
          "service_account_id",
          "kind",
          "mode",
          "status",
          "display",
          "created_at",
          "created_by",
          "expires_at",
          "revoked_at",
          "api_version",
          "requests_per_minute",
          "requests_per_day",
          "rotated_from",
          "rotated_to",
          "grants"
        ],
        "additionalProperties": false
      }
    },
    "next_after": {
      "type": [
        "string",
        "null"
      ],
      "description": "Pass as `after` for the next page; null on the last one."
    }
  },
  "required": [
    "items",
    "next_after"
  ],
  "additionalProperties": false
}

Refusals

not yet declared

The platform refusals apply to every call: version, authentication, authority, validation and rate limits, each in the same envelope.

Surfaces

DesktopF
MobileF
APIF
MCPF
VoiceD4
PushN
OneBoxN
OutboundN
  • Voice: degraded: visualization
  • Push: emits nothing
  • OneBox: no document originates an API key
  • Outbound: crosses to no counterparty

Events

None emitted.

Related

list_capability_events, list_granted_capabilities, list_reports