List API key rows

Módulo Settings

GET/api-keysapiKeys.list

An org-scoped API key with capability scopes and expiry. The secret is shown once and stored hashed. Returns a cursor page of API key rows the caller may see. The default order is `created_at` ascending. Supports sparse fieldsets and the filter grammar.

Requiere la capacidad org.settings.read.
Alcances de OAuth: org.
Paginación por cursor: se aplican limit, cursor, fields, sort y filter.
Estados de error: 400, 401, 429. Los errores son detalles de problema RFC 9457.

Parámetros de ruta y de consulta

apiKeys.list: Parámetros de ruta y de consulta
Campo	Tipo	Obligatorio	Descripción
limit	Limit	No	Page size. Default 50, maximum 200.Restricciones: range 1 to 200
cursor	Cursor	No	Opaque cursor from `next_cursor` of the previous page.Restricciones: length 1 to any
fields	Fields	No	Sparse fieldset: a comma-separated list of top-level fields to return. `id` is always returned.Restricciones: pattern ^[a-z_][a-z0-9_](,[a-z_][a-z0-9_])*$
sort	Sort	No	Sort keys, comma-separated; a leading `-` sorts descending. Without `sort`, the documented default order applies (coded lists sort in numeric code order).Restricciones: pattern ^-?[a-z_][a-z0-9_](,-?[a-z_][a-z0-9_])*$
filter	Filter	No	Filter grammar `filter[field][op]=value`. Operators: eq, ne, lt, lte, gt, gte, in (comma-separated values), is_null (true or false) and contains. Conditions combine with AND.

Respuesta 200: una página de ApiKey

apiKeys.list: ApiKey
Campo	Tipo	Obligatorio	Descripción
id	string (uuid)	Sí	Identifier of the api key.
org_id	string (uuid)	Sí	Identifier of the owning organization, derived from the parent row and never accepted from the caller.
created_at	string (date-time)	Sí	When the row was created.
created_by	string (uuid) \| null	Sí	Identifier of the person who created the row; null when a seed, platform or system process created it.
updated_at	string (date-time)	Sí	When the row was last updated.
updated_by	string (uuid) \| null	Sí	Identifier of the person who last updated the row; null when a seed, platform or system process updated it.
name	string	Sí	Key name.Restricciones: length 1 to 300
service_account_id	string (uuid) \| null	Sí	Identifier of the service account.
scopes	array of string	Sí	Capability groups the key may use.
expires_at	string (date-time)	Sí	Expiry.
prefix	string	Sí	Visible key prefix.Restricciones: pattern ^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$
last_used_at	string (date-time) \| null	Sí	Last use.
revoked_at	string (date-time) \| null	Sí	When it was revoked.
revoked_by	string (uuid) \| null	Sí	Identifier of the person who revoked the key.

{
  "data": [
    {
      "id": "0192f1e2-7c3a-7b4d-9e8f-1a2b3c4d5e6f",
      "org_id": "0192f1e2-7c3a-7b4d-9e8f-1a2b3c4d5e6f",
      "created_at": "2026-10-08T14:30:00Z",
      "created_by": "0192f1e2-7c3a-7b4d-9e8f-1a2b3c4d5e6f",
      "updated_at": "2026-10-08T14:30:00Z",
      "updated_by": "0192f1e2-7c3a-7b4d-9e8f-1a2b3c4d5e6f",
      "name": "Accounting Sync",
      "service_account_id": "0192f1e2-7c3a-7b4d-9e8f-1a2b3c4d5e6f",
      "scopes": [
        "finance"
      ],
      "expires_at": "2026-10-08T14:30:00Z",
      "prefix": "xos_live_7Hq2",
      "last_used_at": "2026-10-08T14:30:00Z",
      "revoked_at": "2026-10-08T14:30:00Z",
      "revoked_by": "0192f1e2-7c3a-7b4d-9e8f-1a2b3c4d5e6f"
    }
  ],
  "next_cursor": null
}

Ejemplos de código

curl -X GET "$XOS_BASE_URL/api-keys" \
  -H "Authorization: Bearer $XOS_API_KEY"

for await (const row of xos.apiKeys.listAll()) {
  console.log(row);
}

for row in xos.api_keys.list_all():
    print(row)

xos api-keys list --all