---
title: "List API keys"
canonical: "https://admiral.io/docs/api/api-keys/ApiKeyAPI_ListApiKeys"
---

# List API keys

`GET https://api.admiral.io/v1/api-keys`

Scope: `apikey:read`

### Query parameters

- `filter` (string): Filter expression to narrow results. Uses the Admiral filter DSL (see the API documentation for the full operator and predicate reference). Filterable fields: - `name`: filter by key name. - `status`: filter by key status (API_KEY_STATUS_ACTIVE, API_KEY_STATUS_REVOKED). Example: `field['status'] = 'API_KEY_STATUS_ACTIVE'` Length at most 1024.
- `page_size` (integer (int32)): Maximum number of keys to return per page. Defaults to 50 when omitted or 0; must not exceed 100. Value 0 to 100.
- `page_token` (string): Opaque pagination token from a previous response.

### Response 200

Success

- `api_keys` (array of ApiKey): The list of keys. Secrets are never included.
  - `id` (string): Unique identifier for the key. Pattern `^key-[0-9a-z]+$`. Read-only.
  - `name` (string): URL-safe, human-readable identifier (e.g., "ci-deploy-key"), unique among the caller's keys. Pattern `^[a-z]([a-z0-9-]{0,61}[a-z0-9])?$`. Length 1 to 63.
  - `scopes` (array of string): The scopes granted to this key, and the ceiling on any access token minted from it. Must be a subset of the caller's own scopes. Items at most 255.
  - `status` (ApiKeyStatus): ApiKeyStatus represents the lifecycle state of an API key. One of `API_KEY_STATUS_UNSPECIFIED`, `API_KEY_STATUS_ACTIVE`, `API_KEY_STATUS_REVOKED`. Read-only.
  - `expires_at` (Timestamp): (IMMUTABLE) When the key expires. Unset never expires. Fixed at creation; tenant policy may cap it.
  - `last_used_at` (Timestamp): When the key was last exchanged for an access token. Minted tokens are reused for their lifetime, so this reads as "still in use" at that granularity, not as the time of the last request. Read-only.
  - `revoked_at` (Timestamp): Set when the key was revoked. Read-only.
  - `created_by` (ActorRef): ActorRef is a lightweight reference to the user or agent that performed an action. Server-populated on all resource responses. Clients should never send this. Read-only.
    - `id` (string): The actor's typed id: a `usr-` user id or an `sa-` service account id.
    - `display_name` (string): Human-readable name (e.g., "John Smith", "deploy-bot").
    - `email` (string): Email address (empty for non-human actors).
  - `created_at` (Timestamp): A point in time in RFC 3339 format, with up to nanosecond precision. Output uses UTC (`Z`); input may use an offset from UTC. Read-only.
- `next_page_token` (string): Pagination token for the next page. Empty when there are no more results.