# List keys

`GET /api/api-keys`  (operationId: `listApiKeys`, group: API keys)

Every key in the workspace with its scopes, expiry, rate limit and last use. The plaintext is never returned again after creation.

Part of the full API, which is included in the Scale plan. Any one of these scopes is enough: `settings`, `settings:read`. Read access for members with the settings permission.

**Response 200**: OK (schema `ApiKeyList`)

| Field | Type | Description |
| --- | --- | --- |
| `keys` | array of ApiKey |  |
| `keys[][].id` | integer |  |
| `keys[][].label` | string |  |
| `keys[][].last_4` | string | Last four characters, for recognising a key. |
| `keys[][].created_at` | string (date-time) |  |
| `keys[][].last_used_at` | string (date-time), nullable |  |
| `keys[][].revoked_at` | string (date-time), nullable |  |
| `keys[][].scopes` | array of string |  |
| `keys[][].read_only` | boolean |  |
| `keys[][].expires_at` | string (date-time), nullable |  |
| `keys[][].expired` | boolean |  |
| `keys[][].rate_limit_per_min` | integer, nullable | Per-key override. |
| `keys[][].effective_rate_limit_per_min` | integer, nullable | What actually applies. Null means unlimited. |
| `keys[][].rotated_from` | integer, nullable |  |
| `keys[][].created_by_name` | string, nullable |  |
| `keys[][].revoked_by_name` | string, nullable |  |
| `defaults` | object |  |
| `defaults.rate_limit_per_min` | integer |  |
| `defaults.max_keys` | integer |  |
| `api_access` | boolean |  |
| `api_tier` | string | What the plan includes: none (Starter), core (Growth), full (Scale). One of: `none`, `core`, `full`. |

Example:

```json
{
  "keys": [
    {
      "id": 7,
      "label": "Dashboard",
      "last_4": "x9Kq",
      "created_at": "2026-09-25T10:00:00.000Z",
      "last_used_at": "2026-10-02T09:29:00.000Z",
      "revoked_at": null,
      "scopes": [
        "inbox:read",
        "team_management:read"
      ],
      "read_only": true,
      "expires_at": "2026-12-24T10:00:00.000Z",
      "expired": false,
      "rate_limit_per_min": 120,
      "effective_rate_limit_per_min": 120,
      "rotated_from": null,
      "created_by_name": "admin@example.com",
      "revoked_by_name": null
    }
  ],
  "defaults": {
    "rate_limit_per_min": 600,
    "max_keys": 20
  },
  "api_access": true,
  "api_tier": "full"
}
```

Part of the InboxWA API reference: https://inboxwa.online/docs/api . Full reference as one document: https://inboxwa.online/docs/api.md . OpenAPI: https://inboxwa.online/openapi.json