---
title: "Get Project Key"
method: GET
path: "/project-keys/{project_key_id}"
tags: ["Project Keys"]
---

# Get Project Key

`GET /project-keys/{project_key_id}`

Get Project Key detail including Kafka ACLs and whitelist IPs for edit modal hydration.

## Path parameters

- `project_key_id` string, required

## Response `200`

Successful Response

- ProjectKeyDetail — Detail response for GET /project-keys/{id} - includes Kafka ACLs, whitelist IPs, and proxy endpoints.
  - `id` string, required
  - `name` string, required
  - `description` string, nullable
  - `created_at` string, date-time, nullable
  - `created_by_user` User
    - `id` string, required
    - `email` string, required
    - `name` string, required
    - `profile_picture_url` string, nullable
    - `phone_number` string, nullable
    - `tenant_id` string, required
    - `created_at` union
      - string
      - string, date-time
    - `last_login` union
      - string
      - string, date-time
  - `api_client_id` string, nullable
  - `api_client_id_masked_secret` string, nullable
  - `kafka_username` string, nullable
  - `service_id` string, required
  - `roles` Role[]
    - `id` string, required
    - `key` string, required
    - `name` string, required
    - `description` string, nullable, required
    - `created_at` union
      - string
      - string, date-time
    - `updated_at` union
      - string
      - string, date-time
    - `permissions` string[]
  - `status` string, required
  - `last_used_at` string, date-time, nullable
  - `tool_profile` 'full' | 'read-only' | 'agent-operator' | 'infra-admin'
  - `allowed_tools` string[], nullable
  - `blocked_tools` string[], nullable
  - `agentic_enabled` boolean — Whether this Project Key is wired up as the auth blob behind the Streamkap MCP. Toggled via POST /project-keys/{id}/enable-agentic and disable-agentic. When true, the encrypted credential lives on the PK row (server-side only); the agent picker on the FE filters to PKs where this is true.
  - `agentic_secret_blob` string, nullable — Always masked to '********' on responses when agentic_enabled is true; null otherwise. Server-derived only - PUT/PATCH bodies that include this field are rejected with 422.
  - `kafka_acls` object[]
  - `whitelist_ips` string, nullable
  - `kafka_proxy_endpoint` string, nullable — Kafka proxy endpoint (e.g. host:32400)
  - `schema_proxy_endpoint` string, nullable — Schema Registry proxy endpoint
  - `token_ttl_seconds` integer — Frontegg JWT token TTL in seconds (dynamic - reflects the current tenant-level authentication token expiration setting in Frontegg). Frontend uses this to display 'role changes take effect within X hours' on role updates.

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.net/streamkap/apis/streamkap-rest-api.md) · [All operations](https://skmtc.net/streamkap/apis/streamkap-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/streamkap/streamkap-rest-api/versions/8aea6143d003/schema)