> ## Documentation Index > Fetch the complete documentation index at: https://docs.barndoor.ai/llms.txt > Use this file to discover all available pages before exploring further. # Get the API key lifetime policy > The org default, per-group overrides and per-user overrides that limit how long self-serve API keys (created by users for themselves) may live. A user's own override wins; otherwise the strictest of their groups' overrides; otherwise the default. Keys created by admins are exempt. Existing keys keep their expiry; the policy is checked when a key is created or rotated. ## OpenAPI ````yaml /api-reference/openapi.yaml get /api/llm-gateway/admin/api-key-lifetime-policies openapi: 3.1.0 info: title: Barndoor.ai Public API description: Unified public API specification for Barndoor.ai platform version: 2.18.0 servers: - url: https://{host} description: Barndoor public API variables: host: default: platform.barndoor.ai description: >- The host serving your Barndoor deployment. Defaults to production; override it for another environment or a dedicated deployment. security: - ApiKey: [] - OAuth2: - openid - profile - email tags: - name: dlp x-group: Data Control Center - name: identity x-group: Identity - name: llm-gateway x-group: LLM Gateway - name: notification x-group: Notifications - name: policy x-group: Policies - name: registry x-group: MCP Gateway - name: system-management x-group: Log Exports paths: /api/llm-gateway/admin/api-key-lifetime-policies: get: tags: - llm-gateway summary: Get the API key lifetime policy description: >- The org default, per-group overrides and per-user overrides that limit how long self-serve API keys (created by users for themselves) may live. A user's own override wins; otherwise the strictest of their groups' overrides; otherwise the default. Keys created by admins are exempt. Existing keys keep their expiry; the policy is checked when a key is created or rotated. operationId: list_lifetime_policies responses: '200': description: The requested record content: application/json: schema: $ref: '#/components/schemas/ApiKeyLifetimePolicies' '401': description: Missing or invalid credentials '403': description: Caller is not permitted to act on this resource in this organization components: schemas: ApiKeyLifetimePolicies: type: object required: - groups - users properties: default: oneOf: - $ref: '#/components/schemas/ApiKeyLifetimePolicy' description: >- The org default; `None` means self-serve keys have no lifetime limit unless a group override applies. - type: 'null' groups: type: array items: $ref: '#/components/schemas/ApiKeyLifetimePolicy' description: >- Per-IdP-group overrides. A user in several of these gets the strictest. users: type: array items: $ref: '#/components/schemas/ApiKeyLifetimeUserOverride' description: >- Per-user overrides. A user's own override wins over their groups and the default. ApiKeyLifetimePolicy: type: object description: >- One stored row: the org default (`group_name: None`) or a group override. required: - id - require_expiry - fixed_lifetime - updated_at properties: fixed_lifetime: type: boolean description: >- Every key gets exactly `max_lifetime_days` and the user doesn't choose (BCP-5229). Requires `max_lifetime_days`. group_name: type: - string - 'null' description: >- `None` for the org default; otherwise the IdP group this overrides it for. id: type: string format: uuid max_lifetime_days: type: - integer - 'null' format: int32 description: |- Longest a key may live, in days from when it is created or rotated. `None` = no maximum. A maximum also rules out a never-expiring key. require_expiry: type: boolean description: The key must have an expiry, even when there is no maximum. updated_at: type: string format: date-time updated_by_user_id: type: - string - 'null' format: uuid ApiKeyLifetimeUserOverride: type: object description: >- A per-user override (BCP-5283). It wins outright: the user's group overrides and the org default don't apply to them. required: - id - user_id - require_expiry - fixed_lifetime - updated_at properties: fixed_lifetime: type: boolean description: >- Every key gets exactly `max_lifetime_days`. Requires `max_lifetime_days`. id: type: string format: uuid max_lifetime_days: type: - integer - 'null' format: int32 description: Longest a key may live, in days. `None` = no maximum. require_expiry: type: boolean description: The key must have an expiry, even when there is no maximum. updated_at: type: string format: date-time updated_by_user_id: type: - string - 'null' format: uuid user_id: type: string format: uuid description: The user this override applies to. securitySchemes: ApiKey: type: http scheme: bearer description: >- A Barndoor API key, sent as `Authorization: Bearer `. Keys are prefixed `bdai_` and are opaque — do not attempt to decode one. Interchangeable with an OAuth 2.0 access token. OAuth2: type: oauth2 x-issuer: https://auth.barndoor.ai/realms/barndoor description: >- An OAuth 2.0 access token from Barndoor's identity provider, sent as `Authorization: Bearer `. Public clients must use PKCE. Interchangeable with an API key. flows: authorizationCode: authorizationUrl: >- https://auth.barndoor.ai/realms/barndoor/protocol/openid-connect/auth tokenUrl: >- https://auth.barndoor.ai/realms/barndoor/protocol/openid-connect/token scopes: openid: Issue an OIDC ID token identifying the caller. profile: Read the caller's basic profile claims. email: Read the caller's email address. offline_access: Issue a refresh token. Optional — no operation requires it. clientCredentials: tokenUrl: >- https://auth.barndoor.ai/realms/barndoor/protocol/openid-connect/token scopes: openid: Issue an OIDC ID token identifying the caller. profile: Read the caller's basic profile claims. email: Read the caller's email address. offline_access: Issue a refresh token. Optional — no operation requires it. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.