> ## Documentation Index > Fetch the complete documentation index at: https://docs.barndoor.ai/llms.txt > Use this file to discover all available pages before exploring further. # Fetch one API key ## OpenAPI ````yaml /api-reference/openapi.yaml get /api/llm-gateway/admin/api-keys/{id} openapi: 3.1.0 info: title: Barndoor.ai Public API description: Unified public API specification for Barndoor.ai platform version: 2.18.0 servers: - url: https://{host} description: Barndoor public API variables: host: default: platform.barndoor.ai description: >- The host serving your Barndoor deployment. Defaults to production; override it for another environment or a dedicated deployment. security: - ApiKey: [] - OAuth2: - openid - profile - email tags: - name: dlp x-group: Data Control Center - name: identity x-group: Identity - name: llm-gateway x-group: LLM Gateway - name: notification x-group: Notifications - name: policy x-group: Policies - name: registry x-group: MCP Gateway - name: system-management x-group: Log Exports paths: /api/llm-gateway/admin/api-keys/{id}: get: tags: - llm-gateway summary: Fetch one API key operationId: get_api_key parameters: - name: id in: path description: Identifier, a UUID required: true schema: type: string format: uuid responses: '200': description: The requested record content: application/json: schema: $ref: '#/components/schemas/ApiKey' '401': description: Missing or invalid credentials '403': description: Caller is not permitted to act on this resource in this organization '404': description: No such resource in this organization components: schemas: ApiKey: type: object required: - id - org_id - kind - created_by_user_id - name - key_prefix - scopes - created_at properties: created_at: type: string format: date-time created_by_user_id: type: string format: uuid disabled_at: type: - string - 'null' format: date-time description: |- When this key was temporarily disabled. Unlike `revoked_at` this is reversible: the auth path rejects the key while set, but re-enabling (clearing it) restores access without re-issuing the secret. expires_at: type: - string - 'null' format: date-time group_name: type: - string - 'null' description: >- Optional explicit IdP group binding for this key. NULL means no explicit group; the key still inherits the assigned user's IdP groups at request time for governance scope matching. id: type: string format: uuid key_prefix: type: string kind: $ref: '#/components/schemas/ApiKeyKind' description: Category of credential (BCP-3510). Set at insert, never updated. last_used_at: type: - string - 'null' format: date-time description: >- When this key last authenticated a request. `None` means it has never been used. Updated best-effort and throttled on the auth path (see `touch_last_used`), so it is accurate to within `last_used_min_interval`. name: type: string org_id: type: string format: uuid previous_key_expires_at: type: - string - 'null' format: date-time description: >- End of the grace period granted by the last rotation: until then the previous secret still authenticates as this key. `None`, or a time in the past, means only the current secret works. revoked_at: type: - string - 'null' format: date-time rotated_at: type: - string - 'null' format: date-time description: >- When the secret was last replaced in place (BCP-5195). `None` means the key still carries the secret it was created with. scopes: type: array items: type: string user_id: type: - string - 'null' format: uuid ApiKeyKind: type: string description: >- What category of credential a row is (BCP-3510) — the first-class answer to "is this an ephemeral governed agent-session key?", which the service used to get by pattern-matching [`AGENT_SESSION_SCOPE`] inside `scopes`. Distinct from [`ActorKind`], which answers a different question. `kind` is about **lifecycle**: who may list it, who may revoke it, and whether the reaper may delete it. `ActorKind` is about **attribution**: whose name goes on an event. That is why `Machine` here covers both the pure service key and the IdP-group-bound key that `ActorKind` keeps apart — the two are listed, revoked and reaped identically, and only the audit trail cares which is which. enum: - user - machine - agent_session securitySchemes: ApiKey: type: http scheme: bearer description: >- A Barndoor API key, sent as `Authorization: Bearer `. Keys are prefixed `bdai_` and are opaque — do not attempt to decode one. Interchangeable with an OAuth 2.0 access token. OAuth2: type: oauth2 x-issuer: https://auth.barndoor.ai/realms/barndoor description: >- An OAuth 2.0 access token from Barndoor's identity provider, sent as `Authorization: Bearer `. Public clients must use PKCE. Interchangeable with an API key. flows: authorizationCode: authorizationUrl: >- https://auth.barndoor.ai/realms/barndoor/protocol/openid-connect/auth tokenUrl: >- https://auth.barndoor.ai/realms/barndoor/protocol/openid-connect/token scopes: openid: Issue an OIDC ID token identifying the caller. profile: Read the caller's basic profile claims. email: Read the caller's email address. offline_access: Issue a refresh token. Optional — no operation requires it. clientCredentials: tokenUrl: >- https://auth.barndoor.ai/realms/barndoor/protocol/openid-connect/token scopes: openid: Issue an OIDC ID token identifying the caller. profile: Read the caller's basic profile claims. email: Read the caller's email address. offline_access: Issue a refresh token. Optional — no operation requires it. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.