--- title: "POST /list-items" method: POST path: "/list-items" tags: ["v2"] --- # POST /list-items `POST /list-items` ## Request body - ListItems - `accessibility` string — for personal password manager - `advanced-filter` string — Filter by item name/username/website or part of it - `ara-only` boolean — Filter by items with ARA functionality enabled - `auto-pagination` string — Retrieve all items using pagination, when disabled retrieving only first 1000 items - `current-folder` boolean — List only items in the current folder (excludes subfolders) - `filter` string — Filter by item name or part of it - `json` boolean — Set output format to JSON - `minimal-view` boolean — Show only basic information of the items - `modified-after` integer — List only secrets modified after specified date (in unix time) - `pagination-token` string — Next page reference - `path` string — Path to folder - `sra-only` boolean — Filter by items with SRA functionality enabled - `sub-types` string[] - `tag` string — Filter by item tag - `token` string — Authentication token (see `/auth` and `/configure`) - `type` string[] — The item types list of the requested items. In case it is empty, all types of items will be returned. options: [key, static-secret, dynamic-secret, classic-key] - `uid-token` string — The universal identity token, Required only for universal_identity authentication ## Response `200` listItemsResponse wraps response body. - ListItemsInPathOutput - `folders` string[] - `has_next` boolean - `items` Item[] - `access_date` string, date-time - `access_date_display` string - `access_request_status` string - `auto_rotate` boolean - `bastion_details` BastionsList - `clusters` BastionListEntry[] - `access_id` string - `allowed_access_ids` string[] - `allowed_urls` string[] - `allowed_urls_per_instance` object - `bastion_ssh_port` integer - `bastion_urls_per_type` object - `cluster_name` string - `display_name` string - `has_gateway_identity` boolean - `last_report` string, date-time - `cert_issuer_signer_key_name` string - `certificate_issue_details` CertificateIssueInfo - `cert_issuer_type` string - `max_ttl` integer - `pki_cert_issuer_details` PKICertificateIssueDetails - `acme_enabled` boolean - `allow_any_name` boolean - `allow_copy_ext_from_csr` boolean - `allow_subdomains` boolean - `allowed_domains_list` string[] - `allowed_extra_extensions` AllowedExtraExtensions - `allowed_ip_sans` string[] - `allowed_uri_sans` string[] - `auto_renew_certificate` boolean - `basic_constraints_valid_for_non_ca` boolean - `certificate_authority_mode` string - `client_flag` boolean - `code_signing_flag` boolean - `country` string[] - `create_private_crl` boolean - `create_private_ocsp` boolean — CreatePrivateOcsp enables exposing an OCSP endpoint on the Gateway and embedding its URL in the AIA extension of issued certificates. - `create_public_crl` boolean - `create_public_ocsp` boolean — CreatePublicOcsp enables exposing a public OCSP endpoint on the Gateway and embedding its URL in the AIA extension of issued certificates. - `destination_path` string — DestinationPath is the destination to save generated certificates - `disable_wildcards` boolean - `enforce_hostnames` boolean - `expiration_events` CertificateExpirationEvent[] — ExpirationNotification holds a list of expiration notices that should be sent in case a certificate is about to expire, this value is being propagated to the Certificate resources that are created - `seconds_before` integer - `gw_cluster_id` integer - `gw_cluster_url` string — GWClusterURL is required when CAMode is "public" and it defines the cluster URL the PKI should be issued from. The GW cluster must have permissions to read associated target's details - `is_ca` boolean - `key_bits` integer - `key_type` string - `key_usage_list` string[] - `locality` string[] - `max_path_len` integer - `non_critical_key_usage` boolean - `not_before_duration` integer — A Duration represents the elapsed time between two instants as an int64 nanosecond count. The representation limits the largest representable duration to approximately 290 years. - `ocsp_next_update` integer — OcspNextUpdate defines the desired NextUpdate window for OCSP responses. Value is in seconds; 0 means not set. Minimum enforced is 10 minutes. - `organization_list` string[] - `organization_unit_list` string[] - `pki_issuer_type` string - `postal_code` string[] - `protect_generated_certificates` boolean — ProtectGeneratedCertificates dictates whether the created certificates should be protected from deletion - `province` string[] - `renew_before_expiration_in_days` integer - `require_cn` boolean - `server_flag` boolean - `street_address` string[] - `ssh_cert_issuer_details` SSHCertificateIssueDetails - `allowed_domains` string[] — Relevant for host certificate - `allowed_user_key_lengths` object - `allowed_users` string[] — Relevant for user certificate - `cert_type` integer - `critical_options` object - `extensions` object - `externally_provided_user_sub_claim_key` string — ExternallyProvidedUserSubClaimKey is the claim key name where the user name should be taken from - `is_externally_provided_user` boolean — IsExternallyProvidedUser is true if allow users should be taken from claims and not from AllowedUsers - `principals` string[] - `static_key_id` string — In case it is empty, the key ID will be combination of user identifiers and a random string - `certificates` string - `client_permissions` string[] - `creation_date` string, date-time - `customer_fragment_id` string - `delete_protection` boolean - `deletion_date` string, date-time - `display_id` string - `gateway_details` GatewayDetailsForItemReplyObj[] - `cluster_id` integer - `cluster_name` string - `cluster_url` string - `desktop_app` DesktopAppConf - `default_cert_issuer_id` integer - `default_cert_issuer_name` string - `secure_web_access_url` string - `secure_web_proxy_url` string - `is_cluster_available` boolean - `is_access_request_enabled` boolean - `is_enabled` boolean - `item_accessibility` integer - `item_custom_fields_details` ItemCustomFieldsDetails[] - `field_id` integer - `id` integer - `name` string - `required` boolean - `value` string - `item_general_info` ItemGeneralInfo - `agentic_rules` AgenticRules - `input_rules` AgenticRule[] - `name` string - `rule` string - `output_rules` AgenticRule[] - `name` string - `rule` string - `cert_issue_details` CertificateIssueInfo - `cert_issuer_type` string - `max_ttl` integer - `pki_cert_issuer_details` PKICertificateIssueDetails - `acme_enabled` boolean - `allow_any_name` boolean - `allow_copy_ext_from_csr` boolean - `allow_subdomains` boolean - `allowed_domains_list` string[] - `allowed_extra_extensions` AllowedExtraExtensions - `allowed_ip_sans` string[] - `allowed_uri_sans` string[] - `auto_renew_certificate` boolean - `basic_constraints_valid_for_non_ca` boolean - `certificate_authority_mode` string - `client_flag` boolean - `code_signing_flag` boolean - `country` string[] - `create_private_crl` boolean - `create_private_ocsp` boolean — CreatePrivateOcsp enables exposing an OCSP endpoint on the Gateway and embedding its URL in the AIA extension of issued certificates. - `create_public_crl` boolean - `create_public_ocsp` boolean — CreatePublicOcsp enables exposing a public OCSP endpoint on the Gateway and embedding its URL in the AIA extension of issued certificates. - `destination_path` string — DestinationPath is the destination to save generated certificates - `disable_wildcards` boolean - `enforce_hostnames` boolean - `expiration_events` CertificateExpirationEvent[] — ExpirationNotification holds a list of expiration notices that should be sent in case a certificate is about to expire, this value is being propagated to the Certificate resources that are created - `seconds_before` integer - `gw_cluster_id` integer - `gw_cluster_url` string — GWClusterURL is required when CAMode is "public" and it defines the cluster URL the PKI should be issued from. The GW cluster must have permissions to read associated target's details - `is_ca` boolean - `key_bits` integer - `key_type` string - `key_usage_list` string[] - `locality` string[] - `max_path_len` integer - `non_critical_key_usage` boolean - `not_before_duration` integer — A Duration represents the elapsed time between two instants as an int64 nanosecond count. The representation limits the largest representable duration to approximately 290 years. - `ocsp_next_update` integer — OcspNextUpdate defines the desired NextUpdate window for OCSP responses. Value is in seconds; 0 means not set. Minimum enforced is 10 minutes. - `organization_list` string[] - `organization_unit_list` string[] - `pki_issuer_type` string - `postal_code` string[] - `protect_generated_certificates` boolean — ProtectGeneratedCertificates dictates whether the created certificates should be protected from deletion - `province` string[] - `renew_before_expiration_in_days` integer - `require_cn` boolean - `server_flag` boolean - `street_address` string[] - `ssh_cert_issuer_details` SSHCertificateIssueDetails - `allowed_domains` string[] — Relevant for host certificate - `allowed_user_key_lengths` object - `allowed_users` string[] — Relevant for user certificate - `cert_type` integer - `critical_options` object - `extensions` object - `externally_provided_user_sub_claim_key` string — ExternallyProvidedUserSubClaimKey is the claim key name where the user name should be taken from - `is_externally_provided_user` boolean — IsExternallyProvidedUser is true if allow users should be taken from claims and not from AllowedUsers - `principals` string[] - `static_key_id` string — In case it is empty, the key ID will be combination of user identifiers and a random string - `certificate_chain_info` CertificateChainInfo - `auto_renew_certificate` boolean - `certificate_chain` CertificateInfo[] - `ExtKeyUsage` ExtKeyUsage[] - `KeyUsage` integer — KeyUsage represents the set of actions that are valid for a given key. It's a bitmap of the KeyUsage* constants. - `crl_distribution_points` string[] - `dns_names` string[] - `email_addresses` string[] - `extensions` Extension[] - `Critical` boolean - `Name` string - `Value` string - `ip_addresses` string[] - `is_ca` boolean - `issuer` Name — Name represents an X.509 distinguished name. This only includes the common elements of a DN. Note that Name is only an approximation of the X.509 structure. If an accurate representation is needed, asn1.Unmarshal the raw subject or issuer as an [RDNSequence]. - `Country` string[] - `ExtraNames` AttributeTypeAndValue[] — ExtraNames contains attributes to be copied, raw, into any marshaled distinguished names. Values override any attributes with the same OID. The ExtraNames field is not populated when parsing, see Names. - … - `Locality` string[] - `Names` AttributeTypeAndValue[] — Names contains all parsed attributes. When parsing distinguished names, this can be used to extract non-standard attributes that are not parsed by this package. When marshaling to RDNSequences, the Names field is ignored, see ExtraNames. - … - `SerialNumber` string - `StreetAddress` string[] - `issuing_certificate_url` string[] - `key_size` integer - `not_after` string, date-time - `not_before` string, date-time - `ocsp_server` string[] - `public_key_algorithm_name` string - `serial_number` string - `sha_1_fingerprint` string - `sha_256_fingerprint` string - `signature` string - `signature_algorithm_name` string - `subject` Name — Name represents an X.509 distinguished name. This only includes the common elements of a DN. Note that Name is only an approximation of the X.509 structure. If an accurate representation is needed, asn1.Unmarshal the raw subject or issuer as an [RDNSequence]. - `Country` string[] - `ExtraNames` AttributeTypeAndValue[] — ExtraNames contains attributes to be copied, raw, into any marshaled distinguished names. Values override any attributes with the same OID. The ExtraNames field is not populated when parsing, see Names. - … - `Locality` string[] - `Names` AttributeTypeAndValue[] — Names contains all parsed attributes. When parsing distinguished names, this can be used to extract non-standard attributes that are not parsed by this package. When marshaling to RDNSequences, the Names field is ignored, see ExtraNames. - … - `SerialNumber` string - `StreetAddress` string[] - `subject_public_key` string - `uris` string[] - `version` integer - `certificate_format` string - `certificate_has_private_key` boolean - `certificate_issuer_gw_cluster_id` integer - `certificate_issuer_gw_cluster_url` string - `certificate_issuer_item_id` integer - `certificate_issuer_name` string - `certificate_pem` string - `certificate_status` string - `common_name` string - `csr_pem` string — CSRPEM contains the PEM-encoded CSR for pending certificates (HTTP-01 challenge) - `error_message` string - `expiration_date` string, date-time - `expiration_events` CertificateExpirationEvent[] - `seconds_before` integer - `external_ca_id` NullString — var s NullString err := db.QueryRow("SELECT name FROM foo WHERE id=?", id).Scan(&s) ... if s.Valid { use s.String } else { NULL value } - `String` string - `Valid` boolean - `issuance_status` string - `not_before` string, date-time - `renew_before_expiration_in_days` integer - `certificate_format` string - `certificates_template_info` CertificateTemplateInfo - `common_name` string - `country` string - `csr_cnf_base_64` string - `digest_algo` string - `hash_algorithm` string - `locality` string - `organization` string - `province` string - `self_signed_enabled` boolean - `ttl` integer - `classic_key_details` ClassicKeyDetailsInfo - `classic_key_attributes` object - `classic_key_id` string - `credential_id` string - `gw_cluster_id` integer - `has_certificate` boolean - `is_provided_by_user` boolean - `is_unexportable` boolean - `key_state` string — ItemState defines the different states an Item can be in - `key_type` string - `last_error` string - `public_key` string - `target_alias_helper` string - `target_types` string[] - `targets` ClassicKeyTargetInfo[] - `external_kms_id` ExternalKMSKeyId - `key_id` string - `key_reference` string - `key_purpose` ClassicKeyPurpose[] - `key_status` ClassicKeyStatusInfo - `error_date` string, date-time - `last_error` string - `last_status` string — ClassicKeyTargetStatus defines status of classic key target - `version` integer - `target_assoc_id` string - `target_type` string - `username` string - `websites` string[] - `cluster_gw_url` string - `display_metadata` string - `dynamic_secret_producer_details` DynamicSecretProducerInfo — DynamicSecretProducerInfo The dynamic secret producer info This parameter relevant and required only in case of create update dynamic secret. - `failure_message` string - `gw_cluster_id` integer - `k8s_allowed_namespaces` string — Relevant only for generic k8s producer - `k8s_dynamic_mode` boolean — Relevant only for generic k8s producer - `producer_last_keep_alive` string - `producer_metadata` string - `producer_status` string — RotationStatus defines types of rotation Status - `producer_type` string - `user_ttl` string - `expiration_events` CertificateExpirationEvent[] - `seconds_before` integer - `importer_info` ImporterInfo - `external_item_id` string - `version` integer - `issuer_overview_info` IssuerOverviewInfo - `certificate_authority_mode` string - `expiration_date` string, date-time - `key_type` string - `next_rotation_events` NextAutoRotationEvent[] - `seconds_before` integer - `oidc_client_info` OidcClientInfo - `access_permission_assignment` AccessOrGroupPermissionAssignment[] - `access_id` string - `access_type` string - `assignment_name` string - `assignment_type` string - `group_id` string - `sub_claims` object - `audience` string[] - `client_id` string - `grant_types` string[] - `issuer_url` string - `logout_uris` string[] - `public` boolean - `redirect_uris` string[] - `response_types` string[] - `scopes` string[] - `password_policy` PasswordPolicyInfo - `password_length` integer - `use_capital_letters` boolean - `use_lower_letters` boolean - `use_numbers` boolean - `use_special_characters` boolean - `rotated_secret_details` RotatedSecretDetailsInfo — RotatedSecretDetailsInfo The rotated secret rotator info - `delete_previous_version_in_days` integer - `enable_custom_password_policy` boolean - `grace_rotation` boolean - `grace_rotation_hour` integer - `grace_rotation_interval` integer - `grace_rotation_timing` string - `gw_cluster_id` integer - `iis_apps_details` WindowsService[] - `attributes` WindowsServiceAttributes - `connection_type` string - `iis_app_pool` boolean — IISAppPool marks this entry as an IIS Application Pool rather than a Windows Service - `port` string - `skip_restart` boolean — SkipRestart allows skipping recycle/start of the IIS App Pool after credential update - `use_tls` boolean - `host` string - `name` string - `last_rotation_error` string - `managed_by_akeyless` boolean - `max_versions` integer - `next_auto_rotate_type` string - `number_of_versions_to_save` integer - `public_key_remote_path` string - `rotation_hour` integer - `rotation_interval_min` boolean - `rotation_statement` string - `rotator_creds_type` string - `rotator_status` string — RotationStatus defines types of rotation Status - `rotator_type` string - `same_password` boolean - `services_details` WindowsService[] - `attributes` WindowsServiceAttributes - `connection_type` string - `iis_app_pool` boolean — IISAppPool marks this entry as an IIS Application Pool rather than a Windows Service - `port` string - `skip_restart` boolean — SkipRestart allows skipping recycle/start of the IIS App Pool after credential update - `use_tls` boolean - `host` string - `name` string - `timeout_seconds` integer - `secure_remote_access_details` SecureRemoteAccess - `account_id` string - `allow_port_forwarding` boolean - `allow_providing_external_username` boolean - `bastion_api` string - `bastion_issuer` string - `bastion_issuer_id` integer - `bastion_ssh` string - `block_concurrent_connections` boolean - `block_concurrent_connections_level` string - `category` string - `connection_delay_seconds` integer - `dashboard_url` string - `db_name` string - `domain` string - `enable` boolean - `endpoint` string - `enforce_hosts_restriction` boolean - `gw_cluster_id` integer - `host` string[] - `host_provider_type` string - `is_cli` boolean - `is_desktop_app` boolean - `is_web` boolean - `isolated` boolean - `lock_during_sra_session` boolean - `native` boolean - `rd_gateway_server` string - `rdp_user` string - `region` string - `rotate_after_disconnect` boolean - `rotate_after_disconnect_delay_mins` integer - `schema` string - `ssh_password` boolean - `ssh_private_key` boolean - `ssh_user` string - `status_info` ItemSraStatus - `count_by_host_info` object - `count_info` object - `hosts_in_use` string[] - `is_in_use` boolean - `last_used_item` string, date-time - `target_hosts` TargetNameWithHosts[] - `hosts` string[] - `target_name` string - `targets` string[] - `url` string - `use_internal_bastion` boolean - `web_proxy` boolean - `static_secret_info` StaticSecretDetailsInfo - `format` string — StaticSecretFormat defines the format of static secret (e.g. Text) - `max_versions` integer - `notify_on_change_event` boolean - `password_security_info` PasswordSecurityInfo - `breach_info` PasswordBreachInfo - `breach_check_date` string, date-time - `breach_count` integer - `breach_suggestions` PasswordBreachSuggestion[] - `status` string - `score_info` PasswordScoreInfo - `score` integer - `status` string - `suggestions` PasswordScoreSuggestion[] - `username` string - `website` string — deprecated - `websites` string[] - `tokenizer_info` TokenizerInfo - `vaultless_tokenizer_info` VaultlessTokenizerInfo - `email_tokenizer_info` EmailTokenizerInfo — EmailTokenizerInfo represents a tokenizer that specifically tokenizes emails - `domain_suffix_length` integer — What length of a random domain suffix to generate used only if FixedDomainSuffix is empty - `fixed_domain_suffix` string — if FixedDomainSuffix isn't empty, it will be appended to the output - `keep_prefix_length` integer — How many letters of the plaintext to keep in the output - `key_name` string - `regexp_tokenizer_info` RegexpTokenizerInfo — RegexpTokenizerInfo represents a general Regexp tokenization template - `alphabet` string — The Alphabet used for the tokenization - `decoding_template` string — Transformation to perform on the decrypted data - `encoding_template` string — Transformation to perform on the encrypted data, if the required output template doesn't match the input string The output Should still be valid for the Pattern, otherwise the secret would be able to be decrypted. - `pattern` string — Regexp pattern to extract and deposit the text/encdata - `template_type` string - `tweak` string — Tweak used in the case of internal tweak type - `tweak_type` string - `item_id` integer - `item_metadata` string - `item_name` string - `item_size` integer - `item_state` string — ItemState defines the different states an Item can be in - `item_sub_type` string - `item_tags` string[] - `item_targets_assoc` ItemTargetAssociation[] - `assoc_id` string - `attributes` object - `target_id` integer - `target_name` string - `target_type` string - `item_type` string - `item_versions` ItemVersion[] - `access_date` string, date-time - `access_date_display` string - `access_id` string - `certificate_version_info` CertificateVersionInfo - `not_after` string, date-time - `not_before` string, date-time - `status` string - `creation_date` string, date-time - `customer_fragment_id` string - `deletion_date` string, date-time - `item_version_state` string — ItemState defines the different states an Item can be in - `modification_date` string, date-time - `protection_key_name` string - `unique_identifier` string - `version` integer - `with_customer_fragment` boolean - `last_rotation_date` string, date-time - `last_version` integer - `linked_details` LinkedDetails - `hosts` object - `locking_info` LockingInfo - `actions` string[] - `expire_at` integer - `locked_by` string - `unique_identifier` string - `modification_date` string, date-time - `next_rotation_date` string, date-time - `protection_key_name` string - `protection_key_type` string - `public_value` string - `rotation_interval` integer - `shared_by` RuleAssigner - `access_id` string - `unique_id` string - `target_versions` TargetItemVersion[] - `access_date` string, date-time - `access_date_display` string - `access_id` string - `certificate_version_info` CertificateVersionInfo - `not_after` string, date-time - `not_before` string, date-time - `status` string - `creation_date` string, date-time - `customer_fragment_id` string - `deletion_date` string, date-time - `item_version_state` string — ItemState defines the different states an Item can be in - `latest_version` boolean - `modification_date` string, date-time - `protection_key_name` string - `target_name` string - `unique_identifier` string - `version` integer - `with_customer_fragment` boolean - `usc_sync_associated_items` ItemUSCSyncAssociation[] — for USC item, hold rotated-secrets that are associated to him for rotated-secret, holds the associated USCs - `assoc_id` string - `attributes` UscSyncInfo - `delete_remote` boolean - `jq_secret_filter` string - `last_error` string - `namespace` string - `secret_id` string - `secret_name` string - `delete_remote` boolean - `item_id` integer - `item_name` string - `item_type` string - `with_customer_fragment` boolean - `next_page` string ## Other responses - `default` — errorResponse wraps any error to return it as a JSON object with one "error" field. --- [API](https://skmtc.net/akeyless/apis/akeyless-api.md) · [All operations](https://skmtc.net/akeyless/apis/akeyless-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/akeyless/akeyless-api/versions/0ceb25634501/schema)