# List keys URL: https://docs.hanzo.ai/docs/openapi/iam/get-iam-keys > Returns an organization's API keys, newest first — what each is called, what it may reach, its publishable half, and when it was last used. `GET /v1/iam/keys` > [IAM →](https://docs.hanzo.ai/docs/openapi/iam) · [All API references →](https://docs.hanzo.ai/docs/openapi) · [Get started →](https://docs.hanzo.ai/docs/guides) | | | | ------------- | -------------------------------------- | | **Address** | `https://api.hanzo.ai/v1/iam/keys` | | **Method** | `GET` | | **Operation** | `get_iam_keys` | | **Auth** | `Authorization: Bearer $HANZO_API_KEY` | Returns an organization's API keys, newest first — what each is called, what it may reach, its publishable half, and when it was last used. Secret halves are never listed. Which organization comes from your credentials, not from the request: you read your own and no one else's. The capability that admits a confidential client to this collection does not itself name a tenant, so the tenant is decided here. ## Request 1 field. | Field | In | Type | Required | Description | | ------- | ----- | ------ | -------- | ----------- | | `owner` | query | string | — | | ## Response | Status | Body | Meaning | | --------- | --------------------- | ----------------- | | `200` | iam.keys.ListResponse | ok | | `202` | Approval | held for approval | | `default` | problem-details | refused | `200` body — 25 fields. | Field | In | Type | Always | Description | | --------------------------- | ---- | ------------------ | ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `keys` | body | iam.Key\[] | — | | | `keys[].accessKey` | body | string | — | AccessKey (pk-\*) is the publishable identifier and lookup index; AccessSecret (sk-\*) is the confidential secret. | | `keys[].accessSecret` | body | string | — | | | `keys[].accessSecretDigest` | body | string | — | AccessSecretDigest is how a presented secret finds its key: the resolver digests what the caller sent and looks THAT up. | | `keys[].act` | body | boolean | — | Act is the durable, opt-in grant that lets this key act FOR a user in its own org — the credential behind as(): presenting it authorizes minting a short-lived, user-bound token for a member of the key's tenant. | | `keys[].application` | body | string | — | | | `keys[].createdAt` | body | string (date-time) | — | | | `keys[].createdTime` | body | string | — | CreatedTime and UpdatedTime are RFC3339 audit stamps carried as strings for byte-parity with the v1 row (orm.Model separately tracks CreatedAt / UpdatedAt as time.Time for the store's own lifecycle). | | `keys[].deleted` | body | boolean | — | | | `keys[].displayName` | body | string | — | DisplayName is the human-facing label. | | `keys[].expireTime` | body | string | — | ExpireTime is when the key stops being honored (empty = never). | | `keys[].id` | body | string | — | | | `keys[].name` | body | string | — | | | `keys[].organization` | body | string | — | | | `keys[].owner` | body | string | — | Owner is the tenant that holds the key; Name is unique within Owner. | | `keys[].prefix` | body | string | — | Prefix is the head of the credential the holder presents — the sk- of a secret key, the pk- of a publishable one — recorded when the key is minted (PrefixOf). | | `keys[].revokeTime` | body | string | — | | | `keys[].revoker` | body | string | — | Revoker is who revoked the key and RevokeTime when. | | `keys[].scope` | body | string | — | Scope is the key's ACCESS CLASS, orthogonal to Type (which names the bound principal). | | `keys[].state` | body | string | — | | | `keys[].type` | body | string | — | Type is the scope the key is bound to — "Organization", "Application", "User", or "General" — and Organization / Application / User name the concrete principal for whichever scope Type selects. | | `keys[].updatedAt` | body | string (date-time) | — | | | `keys[].updatedTime` | body | string | — | | | `keys[].usedTime` | body | string | — | UsedTime is when the key was last presented and resolved. | | `keys[].user` | body | string | — | | Failure carries the platform error shape — see [Errors](https://docs.hanzo.ai/docs/errors). ## Examples **CLI** ```bash hanzo iam keys list ``` **SDK** **.ts** ```ts import { Configuration, IamApi } from 'hanzoai'; const api = new IamApi(new Configuration({ accessToken: process.env.HANZO_API_KEY })); const { data } = await api.getIamKeys(); ``` **.py** ```python from hanzoai.cloud import ApiClient, Configuration from hanzoai.cloud.api import IamApi client = ApiClient(Configuration(access_token=os.environ["HANZO_API_KEY"])) result = IamApi(client).get_iam_keys() ``` **.go** ```go cfg := hanzoai.NewConfiguration() cfg.AddDefaultHeader("Authorization", "Bearer "+os.Getenv("HANZO_API_KEY")) client := hanzoai.NewAPIClient(cfg) resp, _, err := client.IamAPI.GetIamKeys(context.Background()).Execute() if err != nil { return err } ``` **.rs** ```rust use hanzo_client::apis::{configuration::Configuration, iam_api}; let mut cfg = Configuration::new(); cfg.bearer_access_token = std::env::var("HANZO_API_KEY").ok(); let result = iam_api::get_iam_keys(&cfg, Default::default()).await?; ``` **.java** ```java import ai.hanzo.cloud.ApiClient; import ai.hanzo.cloud.api.IamApi; ApiClient client = new ApiClient(); client.setBearerToken(System.getenv("HANZO_API_KEY")); var result = new IamApi(client).getIamKeys(); ``` **HTTP** ```bash curl https://api.hanzo.ai/v1/iam/keys \ -H "Authorization: Bearer $HANZO_API_KEY" ``` **MCP** MCP reaches **iam** through the `iam` tool, which names its 44 operations with its own verbs — this one among them, under a name only MCP declares. `describe` explains any of them: ```bash curl -X POST https://api.hanzo.ai/v1/mcp \ -H "Content-Type: application/json" \ -d '{ "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": "describe", "arguments": { "op": "list_iam_applications" } } }' ``` --- [IAM API](https://docs.hanzo.ai/docs/openapi/iam) · [All Hanzo APIs](https://docs.hanzo.ai/docs/openapi) · [Interactive reference](https://docs.hanzo.ai/docs/openapi/reference)