Skip to main content
GET
List the organization's API keys

Authorizations

Authorization
string
header
required

A Barndoor API key, sent as Authorization: Bearer <key>. Keys are prefixed bdai_ and are opaque — do not attempt to decode one. Interchangeable with an OAuth 2.0 access token.

Response

The requested record

created_at
string<date-time>
required
created_by_user_id
string<uuid>
required
id
string<uuid>
required
key_prefix
string
required
kind
enum<string>
required

Category of credential (BCP-3510). Set at insert, never updated.

Available options:
user,
machine,
agent_session
name
string
required
org_id
string<uuid>
required
scopes
string[]
required
disabled_at
string<date-time> | null

When this key was temporarily disabled. Unlike revoked_at this is reversible: the auth path rejects the key while set, but re-enabling (clearing it) restores access without re-issuing the secret.

expires_at
string<date-time> | null
group_name
string | null

Optional explicit IdP group binding for this key. NULL means no explicit group; the key still inherits the assigned user's IdP groups at request time for governance scope matching.

last_used_at
string<date-time> | null

When this key last authenticated a request. None means it has never been used. Updated best-effort and throttled on the auth path (see touch_last_used), so it is accurate to within last_used_min_interval.

previous_key_expires_at
string<date-time> | null

End of the grace period granted by the last rotation: until then the previous secret still authenticates as this key. None, or a time in the past, means only the current secret works.

revoked_at
string<date-time> | null
rotated_at
string<date-time> | null

When the secret was last replaced in place (BCP-5195). None means the key still carries the secret it was created with.

user_id
string<uuid> | null