---
title: "List API keys"
method: GET
path: "/v2/api-keys"
tags: ["API Keys"]
---

# List API keys

`GET /v2/api-keys`

List API keys. Returns metadata for each key (id, name, description,
key_type, status, redacted_key, created_at, expires_at, created_by_user_id). The raw key
secret is never returned after creation.

Results can be filtered by key type, status, space, and creator. Responses are
paginated; use `limit` and `cursor` and the response `pagination.next_cursor` for
subsequent pages.

**Service keys (`key_type=SERVICE`):** Provide `space_id` to return all service keys for
that space. When `key_type` is omitted alongside `space_id`, service keys are returned
implicitly. Requires the `SERVICE_KEY_READ` permission in the space (or account/space admin).
Optionally combine with `user_id` to filter service keys by their creator — available to any
caller with space access (not admin-gated).

**User keys (`key_type=USER`):** Returned by default (no `space_id`). Provide `user_id` to
view keys belonging to a specific user — account admins only; non-admins receive `403`.

<Note>This endpoint is in beta, read more [here](https://arize.com/docs/ax/rest-reference#api-version-stages).</Note>

## Query parameters

- `key_type` 'USER' | 'SERVICE' — Type of the API key. - USER - Personal key that authenticates as the creating user. - SERVICE - Key that authenticates as a service account with explicitly granted access.
- `status` 'ACTIVE' | 'REVOKED' — Current status of the API key. - ACTIVE - The key is valid for use. - REVOKED - The key has been revoked and is no longer valid.
- `space_id` string — A universally unique identifier (base64-encoded opaque string).
- `user_id` string — A universally unique identifier (base64-encoded opaque string).
- `limit` integer
- `cursor` string

## Response `200`

Returns a list of API keys matching the request filters. The raw key secret is never returned.

- ListApiKeysResponse
  - `api_keys` ApiKey[], required — API keys matching the request filters.
    - `id` string, required — Unique identifier for the API key.
    - `name` string, required — User-defined name for the API key.
    - `description` string — Optional user-defined description for the API key.
    - `key_type` 'USER' | 'SERVICE', required — Type of the API key. - USER - Personal key that authenticates as the creating user. - SERVICE - Key that authenticates as a service account with explicitly granted access.
    - `status` 'ACTIVE' | 'REVOKED', required — Current status of the API key. - ACTIVE - The key is valid for use. - REVOKED - The key has been revoked and is no longer valid.
    - `redacted_key` string, required — Redacted version of the key suitable for display (e.g., "ak-abc...xyz").
    - `created_at` string, date-time, required — Timestamp when the key was created.
    - `expires_at` string, date-time — Optional timestamp when the key will expire.
    - `created_by_user_id` string, required — ID of the user who created the key.
    - `last_used_at` string, date-time — Approximate timestamp when the key was last used for authentication. This value is periodically updated and may not reflect the most recent usage.
  - `pagination` PaginationMetadata, required — Cursor-based pagination metadata. Use `next_cursor` in the subsequent request's `cursor` query parameter.
    - `next_cursor` string — Opaque cursor for fetching the next page. Treat as an unreadable token. Present when `has_more` is true; omitted when `has_more` is false.
    - `has_more` boolean, required — True if another page of results is available.

## Other responses

- `400` — Invalid request
- `401` — Authentication is required
- `403` — Insufficient permissions to access this resource
- `404` — Not found
- `429` — Rate limit exceeded

---

[API](https://skmtc.net/arize-ai/apis/arize-rest-api.md) · [All operations](https://skmtc.net/arize-ai/apis/arize-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/arize-ai/arize-rest-api/versions/2ce448f1de13/schema)