---
title: "Retrieve a specific key registered to a bound device"
method: GET
path: "/v1/mfa/devices/{id}/keys/{key_id}"
tags: ["Device binding"]
---

# Retrieve a specific key registered to a bound device

`GET /v1/mfa/devices/{id}/keys/{key_id}`

Returns a key associated with a specific device that was previously registered using the device binding process.

## Path parameters

- `id` string, required
- `key_id` string, required

## Response `200`

OK

- DeviceKey
  - `key_id` string — ID of the key.
  - `key_purpose` 'restricted' | 'unrestricted' — The purpose of the key (either `restricted` or `unrestricted`).
  - `key_type` 'ecdsa-p256' — The type of key pair used for verifying the device and for device signing. At this time, only `ecdsa-p256` is supported.
  - `used_at` string — The date and time when the key was last used (e.g., for device signing).

## Other responses

- `400` — Validation error
- `401` — Unauthorized
- `403` — Forbidden
- `404` — Not found
- `500` — Internal server error

---

[API](https://skmtc.net/solarisgroup/apis/device-management.md) · [All operations](https://skmtc.net/solarisgroup/apis/device-management/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/solarisgroup/device-management/revisions/80dd46738839/schema)