---
title: "Get all API keys for an account"
method: GET
path: "/rest/api/v1/accounts/{accountId}/apiKeys"
tags: ["Account API"]
---

# Get all API keys for an account

`GET /rest/api/v1/accounts/{accountId}/apiKeys`

## Path parameters

- `accountId` string, uuid, required

## Response `200`

OK

- ApiKeyDTO[]
  - `accessPolicy` ApiKeyAccessPolicyDTO — Access policy configuration for this API key. Controls which AccountInformationDTO fields are visible and which endpoints are accessible.
    - `allowedCorsOrigins` string[] — List of allowed CORS (Cross-Origin Resource Sharing) domains. If specified, only requests from these origins will be allowed. Supports wildcards. Examples: 'https://example.com', 'https://*.example.com', 'http://localhost:3000'. If null or empty, all origins are allowed.
    - `allowedIpAddresses` string[] — List of allowed IP addresses or CIDR subnets. If specified, only requests from these IPs will be allowed. Supports both IPv4 and IPv6. Examples: '192.168.1.100', '10.0.0.0/24', '2001:db8::/32'. If null or empty, all IPs are allowed.
    - `enabled` boolean — Whether the access policy is enabled. If false, all restrictions are disabled and the API key has full access. Default is true.
    - `endpointPolicyMode` 'ALLOW_LIST' | 'DENY_LIST' — Endpoint access policy mode: ALLOW_LIST (only listed endpoints are accessible) or DENY_LIST (listed endpoints are blocked). Default is ALLOW_LIST if not specified.
    - `endpoints` ApiKeyEndpointDTO[] — List of REST endpoints with their HTTP methods. Supports wildcards: '*' for single segment, '**' for multiple segments, '{variable}' for path variables. Examples: '/rest/api/v1/projects/*' matches any direct child, '/rest/api/v1/projects/**' matches all descendants. Behavior depends on endpointPolicyMode: ALLOW_LIST = only these endpoints accessible, DENY_LIST = these endpoints blocked.
      - `method` 'GET' | 'POST' | 'PUT' | 'DELETE', required — HTTP method
      - `path` string, required — REST endpoint path pattern. Supports wildcards: '*' matches one path segment, '**' matches multiple segments, '{variable}' matches path variables. Examples: '/rest/api/v1/projects/*', '/rest/api/v1/projects/**', '/rest/api/v1/projects/{projectId}/strategies'
    - `fieldPolicyMode` 'ALLOW_LIST' | 'DENY_LIST' — Field access policy mode: ALLOW_LIST (only listed fields are visible) or DENY_LIST (listed fields are hidden). Default is DENY_LIST if not specified.
    - `fields` FieldMetadataDTO[] — List of DTO fields with their class name and field name. Allows filtering fields from multiple DTOs. Behavior depends on fieldPolicyMode: ALLOW_LIST = only these fields visible, DENY_LIST = these fields hidden. If null or empty and mode is ALLOW_LIST, no fields are visible. If null or empty and mode is DENY_LIST, all fields are visible.
      - `description` string — Field description from @Schema annotation if available
      - `dtoClassName` string — The DTO class name this field belongs to
      - `fieldName` string — Field name
      - `fieldType` string — Field Java type
    - `hiddenFrontendFeatures` string[] — List of frontend features to hide from the user interface. Frontend application should check this list and hide corresponding UI components. Examples: FINANCIAL_OVERVIEW to hide balance, equity, profit displays.
  - `accountId` string, uuid — You have to set it during resource creation, after that, it is only read-only
  - `alias` string
  - `id` integer
  - `key` string
  - `permissionType` 'READ_WRITE' | 'READ_ONLY' — Permission type: READ_WRITE or READ_ONLY
  - `projectId` string, uuid — You have to set it during resource creation, after that, it is only read-only

---

[API](https://skmtc.net/metacopier/apis/metacopier-api.md) · [All operations](https://skmtc.net/metacopier/apis/metacopier-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/metacopier/metacopier-api/revisions/ff1699330afa/schema)