Skip to main content
GET
List API keys

Authorizations

Authorization
string
header
required

An access token from Barndoor's identity provider, sent as Authorization: Bearer <token>. Use a service-account token from the OAuth 2.0 client-credentials grant for scripts and CI, or a signed-in user's token. The caller needs the admin role in the organization. Gateway API keys (bd-...) are not accepted here.

Response

OK

created_at
string<date-time>
required
created_by_user_id
string<uuid>
required

User who created the key.

id
string<uuid>
required
key_prefix
string
required

First characters of the key, for identifying it. The full key is never returned after creation.

kind
enum<string>
required

user (assigned to a person), machine (a group-bound or service key), or agent_session (a short-lived key for a governed agent session).

Available options:
user,
machine,
agent_session
name
string
required
org_id
string<uuid>
required
scopes
string[]
required
disabled_at
string<date-time> | null

When the key was disabled, if it is. A disabled key is rejected until re-enabled; unlike revocation, this is reversible.

expires_at
string<date-time> | null
group_name
string | null

IdP group the key is bound to, if any. A key without a group still inherits its assigned user's IdP groups for policy matching.

last_used_at
string<date-time> | null

When the key last authenticated a request; null if never used. Updated periodically, so it can lag slightly.

revoked_at
string<date-time> | null
user_id
string<uuid> | null

User the key is assigned to, if any.