List keys

Returns an organization's API keys, newest first — what each is called, what it may reach, its publishable half, and when it was last used.

GET /v1/iam/keys

IAM → · All API references → · Get started →

Address	`https://api.hanzo.ai/v1/iam/keys`
Method	`GET`
Operation	`get_iam_keys`
Auth	`Authorization: Bearer $HANZO_API_KEY`

Returns an organization's API keys, newest first — what each is called, what it may reach, its publishable half, and when it was last used. Secret halves are never listed.

Which organization comes from your credentials, not from the request: you read your own and no one else's. The capability that admits a confidential client to this collection does not itself name a tenant, so the tenant is decided here.

Request

1 field.

Field	In	Type	Required	Description
`owner`	query	string	—

Response

Status	Body	Meaning
`200`	iam.keys.ListResponse	ok
`202`	Approval	held for approval
`default`	problem-details	refused

200 body — 25 fields.

Field	In	Type	Always	Description
`keys`	body	iam.Key[]	—
`keys[].accessKey`	body	string	—	AccessKey (pk-) is the publishable identifier and lookup index; AccessSecret (sk-) is the confidential secret.
`keys[].accessSecret`	body	string	—
`keys[].accessSecretDigest`	body	string	—	AccessSecretDigest is how a presented secret finds its key: the resolver digests what the caller sent and looks THAT up.
`keys[].act`	body	boolean	—	Act is the durable, opt-in grant that lets this key act FOR a user in its own org — the credential behind as(): presenting it authorizes minting a short-lived, user-bound token for a member of the key's tenant.
`keys[].application`	body	string	—
`keys[].createdAt`	body	string (date-time)	—
`keys[].createdTime`	body	string	—	CreatedTime and UpdatedTime are RFC3339 audit stamps carried as strings for byte-parity with the v1 row (orm.Model separately tracks CreatedAt / UpdatedAt as time.Time for the store's own lifecycle).
`keys[].deleted`	body	boolean	—
`keys[].displayName`	body	string	—	DisplayName is the human-facing label.
`keys[].expireTime`	body	string	—	ExpireTime is when the key stops being honored (empty = never).
`keys[].id`	body	string	—
`keys[].name`	body	string	—
`keys[].organization`	body	string	—
`keys[].owner`	body	string	—	Owner is the tenant that holds the key; Name is unique within Owner.
`keys[].prefix`	body	string	—	Prefix is the head of the credential the holder presents — the sk- of a secret key, the pk- of a publishable one — recorded when the key is minted (PrefixOf).
`keys[].revokeTime`	body	string	—
`keys[].revoker`	body	string	—	Revoker is who revoked the key and RevokeTime when.
`keys[].scope`	body	string	—	Scope is the key's ACCESS CLASS, orthogonal to Type (which names the bound principal).
`keys[].state`	body	string	—
`keys[].type`	body	string	—	Type is the scope the key is bound to — "Organization", "Application", "User", or "General" — and Organization / Application / User name the concrete principal for whichever scope Type selects.
`keys[].updatedAt`	body	string (date-time)	—
`keys[].updatedTime`	body	string	—
`keys[].usedTime`	body	string	—	UsedTime is when the key was last presented and resolved.
`keys[].user`	body	string	—

Failure carries the platform error shape — see Errors.

Examples

CLI

SDK

HTTP

MCP

hanzo iam keys list

.ts

.py

.go

.rs

.java

import { Configuration, IamApi } from 'hanzoai';

const api = new IamApi(new Configuration({ accessToken: process.env.HANZO_API_KEY }));
const { data } = await api.getIamKeys();

from hanzoai.cloud import ApiClient, Configuration
from hanzoai.cloud.api import IamApi

client = ApiClient(Configuration(access_token=os.environ["HANZO_API_KEY"]))
result = IamApi(client).get_iam_keys()

cfg := hanzoai.NewConfiguration()
cfg.AddDefaultHeader("Authorization", "Bearer "+os.Getenv("HANZO_API_KEY"))
client := hanzoai.NewAPIClient(cfg)

resp, _, err := client.IamAPI.GetIamKeys(context.Background()).Execute()
if err != nil {
	return err
}

use hanzo_client::apis::{configuration::Configuration, iam_api};

let mut cfg = Configuration::new();
cfg.bearer_access_token = std::env::var("HANZO_API_KEY").ok();

let result = iam_api::get_iam_keys(&cfg, Default::default()).await?;

import ai.hanzo.cloud.ApiClient;
import ai.hanzo.cloud.api.IamApi;

ApiClient client = new ApiClient();
client.setBearerToken(System.getenv("HANZO_API_KEY"));

var result = new IamApi(client).getIamKeys();

curl https://api.hanzo.ai/v1/iam/keys \
  -H "Authorization: Bearer $HANZO_API_KEY"

MCP reaches iam through the iam tool, which names its 44 operations with its own verbs — this one among them, under a name only MCP declares. describe explains any of them:

curl -X POST https://api.hanzo.ai/v1/mcp \
  -H "Content-Type: application/json" \
  -d '{
       "jsonrpc": "2.0",
       "id": 1,
       "method": "tools/call",
       "params": {
         "name": "describe",
         "arguments": {
           "op": "list_iam_applications"
         }
       }
     }'

IAM API · All Hanzo APIs · Interactive reference

Was this page useful?

PreviousList principal NextList linked accounts