---
title: "List capability catalog"
method: GET
path: "/v2/api-keys/capabilities"
tags: ["API keys"]
---

# List capability catalog

`GET /v2/api-keys/capabilities`

Returns the capability catalog: the set of permission domains that can be granted to an API key. Each entry includes the domain id, display name, group, allowed project scopes, and the read / write verb sets resolved at authorize() time. Drives the permissions UI in the dashboard.

## Response `200`

OK

- ListCapabilitiesResponse
  - `domains` Domain[], required — Full capability catalog. Order is stable: workspace-admin first, then platform, then gateway.
    - `id` string — Stable domain identifier (e.g. "agent", "chat_completions"). Used as the key in ApiKey.access and as the verb prefix in resolved permissions (e.g. agent.list, agent.view, agent.create).
    - `display_name` string — Human-readable label for the dashboard.
    - `group` 'DOMAIN_GROUP_WORKSPACE_ADMIN' | 'DOMAIN_GROUP_PLATFORM' | 'DOMAIN_GROUP_GATEWAY'
    - `allowed_scopes` ScopeMode[] — Project scopes this domain may be granted under. A workspace- admin domain like `member` is typically SCOPE_MODE_ALL only.
    - `readable` boolean — Whether this domain can be granted read access.
    - `writable` boolean — Whether this domain can be granted write access.

---

[API](https://skmtc.net/orq-ai/apis/orq-ai-api.md) · [All operations](https://skmtc.net/orq-ai/apis/orq-ai-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/orq-ai/orq-ai-api/revisions/deb8d376faee/schema)