---
title: "List API credential metadata"
method: GET
path: "/api/v1/user/api-credentials"
tags: ["User", "API Credentials"]
---

# List API credential metadata

`GET /api/v1/user/api-credentials`

Account-plane endpoint. Revalidates the session account in users.sqlite and returns a bounded, signed-cursor page of prefixes, last four characters, scopes and lifecycle state; never a token or hash.

## Query parameters

- `limit` integer
- `cursor` string

## Response `200`

Credential metadata and allowed scope catalog

- object
  - `credentials` ApiCredential[]
    - `id` integer, required
    - `name` string, required
    - `prefix` string, required — Non-secret identification prefix.
    - `last4` string, required
    - `hint` string, required
    - `scopes` string[], required
    - `status` 'active' | 'expired' | 'revoked', required
    - `created_at` string, date-time, required
    - `expires_at` string, date-time, nullable
    - `revoked_at` string, date-time, nullable
    - `last_used_at` string, date-time, nullable
    - `rotated_from_id` integer, nullable
    - `legacy_migrated` boolean
  - `allowed_scopes` object — Scope name to human-readable capability description.
  - `token_visible_once` true
  - `max_active` 10
  - `pagination` object
    - `limit` integer, required
    - `has_more` boolean, required
    - `next_cursor` string, nullable, required

## Other responses

- `400` — Invalid request
- `401` — Authentication required (no active session)
- `422` — The query is lexically valid but outside a documented numeric or length bound, or uses an unsupported indexed combination.
- `503` — Account, credential schema or cursor-signing service unavailable

---

[API](https://skmtc.net/openmercantil/apis/openmercantil-public-api.md) · [All operations](https://skmtc.net/openmercantil/apis/openmercantil-public-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/openmercantil/openmercantil-public-api/versions/996f96a11758/schema)