Skip to main content
GET
Retrieve an API key

Authorizations

Authorization
string
header
required

An API key (otsk_ + 64 hex) or a console session token.

Path Parameters

key_id
string
required

The key's id: key_ followed by 32 hex characters. Never the secret.

Response

The key, without its secret.

A key without its secret.

id
string
required
name
string
required
principal
object
required

Who a key acts as: a user, or a service account owned by the organization.

scopes
enum<string>[]
required

A permission a key or session holds.

Available options:
runs_read,
runs_write,
keys_read,
keys_write,
members_read,
members_write,
billing_read,
billing_write,
usage_read
state
enum<string>
required

A revoked key is kept, never deleted.

Available options:
active,
revoked
secret_prefix
string
required

The first 13 characters of the secret (otsk_ plus 8), for display.

created_by
string
required
created_at
string
required
last_used_at
string | null
revoked_at
string | null