---
title: "List delegated signing keys"
method: GET
path: "/auth/delegated-keys"
tags: ["Embedded Wallet Auth"]
---

# List delegated signing keys

`GET /auth/delegated-keys`

List delegated signing keys for an Embedded Wallet internal account, a card funding source, or both, including `PENDING` keys (user created but policy leg never completed) and `REVOKED` keys. At least one of `accountId` or `fundingSourceId` must be supplied.

## Query parameters

- `accountId` string
- `fundingSourceId` string

## Response `200`

Delegated keys matching the supplied filters. Returns an empty `data` array when no matching delegated keys are visible to the caller.

- DelegatedKeyListResponse
  - `data` DelegatedKey[], required — Delegated signing keys matching the list filters.
    - `id` string, required — Grid-issued `DelegatedKey:<uuid>` identifier.
    - `cardId` string, required — The card this key is delegated for.
    - `fundingSourceId` string, required — The card funding source this key is delegated for.
    - `accountId` string, required — The Embedded Wallet internal account this key is delegated for, derived from the card funding source.
    - `publicKey` string, required — Compressed P-256 public key (hex) of the delegated API keypair.
    - `nickname` string, required — Human-readable label for the delegated key.
    - `status` 'PENDING' | 'ACTIVE' | 'REVOKED', required — Status of a delegated signing key. - `PENDING`: The delegated user exists but the policy-creation leg never completed. The key cannot sign. - `ACTIVE`: The policy is granted and the key may stamp quote executions. - `REVOKED`: The delegated user has been deleted and the key can no longer sign.
    - `spendingLimits` DelegatedKeySpendingLimit[] — Per-transaction spending limits the key was created with, at most one entry per currency. Absent when the key has no limits.
      - `currencyCode` string, required — Uppercase alphanumeric currency code the limit applies to — ISO 4217 for fiat (e.g. USD), or a Grid token code for stablecoins (e.g. USDB). Must match the card's currency; requests with any other currency are rejected.
      - `maxPerTransaction` integer, required — Largest amount a single card transaction may authorize, in the smallest unit of the currency (e.g., cents for USD).
    - `createdAt` string, date-time, required — When the delegated key was created.
    - `updatedAt` string, date-time, required — When the delegated key was last updated.

## Other responses

- `400` — Bad request
- `401` — Unauthorized
- `500` — Internal service error

---

[API](https://skmtc.net/stainless-api/apis/grid-api.md) · [All operations](https://skmtc.net/stainless-api/apis/grid-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/stainless-api/grid-api/versions/526036c12609/schema)