List the tenant's API keys

GET

/api-keys

const url = 'https://api.sealpost.app/v1/api-keys?limit=50';
const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url 'https://api.sealpost.app/v1/api-keys?limit=50' \
  --header 'Authorization: Bearer <token>'

Scope api_keys:read. Secrets are never returned; prefix identifies a key.

Authorizations

ApiKey

Parameters

Query Parameters

limit

integer

default: 50 >= 1 <= 100

Page size, 1 to 100.

after

string format: uuid

Cursor, the id of the last item of the previous page. Pages run newest first.

Responses

200

A page of keys, newest first, including revoked ones.

application/json

object

data

required

Array<object>

A key without its secret.

object

required

string format: uuid

name

required

string

prefix

required

The visible start of the secret, e.g. sk_test_3f9aQ2Lm, enough to tell keys apart.

string

mode

required

string

Allowed values: live test

scopes

required

Array<string>

Allowed values: envelopes:read envelopes:write templates:read templates:write webhooks:write tenant:read tenant:write api_keys:read api_keys:write requests:read

rotated_from_id

The key this one replaced, when minted by a rotation.

string | null format: uuid

created_at

required

string format: date-time

last_used_at

required

Updated at most once a minute.

string | null format: date-time

expires_at

required

string | null format: date-time

revoked_at

required

string | null format: date-time

has_more

required

boolean

next_after

Pass as after to fetch the next page.

string | null format: uuid

Example

{
  "data": [
    {
      "mode": "live",
      "scopes": [
        "envelopes:read"
      ]
    }
  ]
}

Headers

Sign-Request-Id

string

Unique id of this request (req_…). Quote it in support requests.

401

No key, an unknown key, or a revoked or expired key.

application/problem+json

RFC 9457 problem details plus a stable code and the request_id.

object

type

required

https://sealpost.app/errors/{code}

string format: uri

title

required

string

status

required

integer

detail

Human-readable, safe to show to a developer, never contains secrets or signer data.

string

instance

The request path.

string

code

required

Stable machine-readable code from the catalogue (docs/errors.md).

string

request_id

required

string

errors

Field-level detail on validation_failed.

Array<object>

object

param

required

JSON pointer-ish path, e.g. scopes[2].

string

message

required

string

Example

{
  "type": "https://sealpost.app/errors/insufficient_scope",
  "title": "Forbidden",
  "status": 403,
  "detail": "This key lacks the api_keys:write scope.",
  "code": "insufficient_scope",
  "request_id": "req_01J9ZK3V8Q4M2XQ7W0E5D1R6TA"
}

Headers

Sign-Request-Id

string

Unique id of this request (req_…). Quote it in support requests.

403

The key is valid but lacks the scope, or a test key tried a live-only action.

application/problem+json

RFC 9457 problem details plus a stable code and the request_id.

object

type

required

https://sealpost.app/errors/{code}

string format: uri

title

required

string

status

required

integer

detail

Human-readable, safe to show to a developer, never contains secrets or signer data.

string

instance

The request path.

string

code

required

Stable machine-readable code from the catalogue (docs/errors.md).

string

request_id

required

string

errors

Field-level detail on validation_failed.

Array<object>

object

param

required

JSON pointer-ish path, e.g. scopes[2].

string

message

required

string

Example

{
  "type": "https://sealpost.app/errors/insufficient_scope",
  "title": "Forbidden",
  "status": 403,
  "detail": "This key lacks the api_keys:write scope.",
  "code": "insufficient_scope",
  "request_id": "req_01J9ZK3V8Q4M2XQ7W0E5D1R6TA"
}

Headers

Sign-Request-Id

string

Unique id of this request (req_…). Quote it in support requests.

422

The request was read but a value is invalid, or an Idempotency-Key was reused with a different body.

application/problem+json

RFC 9457 problem details plus a stable code and the request_id.

object

type

required

https://sealpost.app/errors/{code}

string format: uri

title

required

string

status

required

integer

detail

Human-readable, safe to show to a developer, never contains secrets or signer data.

string

instance

The request path.

string

code

required

Stable machine-readable code from the catalogue (docs/errors.md).

string

request_id

required

string

errors

Field-level detail on validation_failed.

Array<object>

object

param

required

JSON pointer-ish path, e.g. scopes[2].

string

message

required

string

Example

{
  "type": "https://sealpost.app/errors/insufficient_scope",
  "title": "Forbidden",
  "status": 403,
  "detail": "This key lacks the api_keys:write scope.",
  "code": "insufficient_scope",
  "request_id": "req_01J9ZK3V8Q4M2XQ7W0E5D1R6TA"
}

Headers

Sign-Request-Id

string

Unique id of this request (req_…). Quote it in support requests.

429

The key is over its per-minute budget (600 live, 60 test, sliding window).

application/problem+json

RFC 9457 problem details plus a stable code and the request_id.

object

type

required

https://sealpost.app/errors/{code}

string format: uri

title

required

string

status

required

integer

detail

Human-readable, safe to show to a developer, never contains secrets or signer data.

string

instance

The request path.

string

code

required

Stable machine-readable code from the catalogue (docs/errors.md).

string

request_id

required

string

errors

Field-level detail on validation_failed.

Array<object>

object

param

required

JSON pointer-ish path, e.g. scopes[2].

string

message

required

string

Example

{
  "type": "https://sealpost.app/errors/insufficient_scope",
  "title": "Forbidden",
  "status": 403,
  "detail": "This key lacks the api_keys:write scope.",
  "code": "insufficient_scope",
  "request_id": "req_01J9ZK3V8Q4M2XQ7W0E5D1R6TA"
}

Headers

Sign-Request-Id

string

Unique id of this request (req_…). Quote it in support requests.

Retry-After

integer

Seconds to wait before retrying.

RateLimit-Limit

integer

Requests allowed per minute for this key (600 live, 60 test).

RateLimit-Remaining

integer

Requests remaining in the current window.

RateLimit-Reset

integer

Seconds until the window has capacity again.

500

Something failed on our side. The request_id is in our logs.

application/problem+json

RFC 9457 problem details plus a stable code and the request_id.

object

type

required

https://sealpost.app/errors/{code}

string format: uri

title

required

string

status

required

integer

detail

Human-readable, safe to show to a developer, never contains secrets or signer data.

string

instance

The request path.

string

code

required

Stable machine-readable code from the catalogue (docs/errors.md).

string

request_id

required

string

errors

Field-level detail on validation_failed.

Array<object>

object

param

required

JSON pointer-ish path, e.g. scopes[2].

string

message

required

string

Example

{
  "type": "https://sealpost.app/errors/insufficient_scope",
  "title": "Forbidden",
  "status": 403,
  "detail": "This key lacks the api_keys:write scope.",
  "code": "insufficient_scope",
  "request_id": "req_01J9ZK3V8Q4M2XQ7W0E5D1R6TA"
}

Headers

Sign-Request-Id

string

Unique id of this request (req_…). Quote it in support requests.