Skip to main content
GET
List API keys
Plaintext is never returned; id is the key’s SHA-256 hash, which cannot authenticate and is the id DELETE /v1/keys/{id} takes. Rows are scoped to the calling user within their organization; an admin key sees its own keys, not the whole org’s (org-wide listing waits for scoped keys).

Authorization

This route accepts any authenticated Exo API key and checks no additional scope. A missing or invalid credential returns 401 authentication_error. A valid credential without the scope returns 403 permission_denied, and the problem body names the exact scope required.

Headers

These are request conventions the contract does not declare as parameters, so they do not appear in the schema tables below.

Success responses

Errors

Every error is an RFC 9457 application/problem+json body carrying a stable code, a requestId, and a suggestedAction where Exo has one. See Errors.

Authorizations

X-Exo-API-Key
string
header
required

An Exo API key (exo_...) sent as the X-Exo-API-Key header.

Response

Successful Response

keys
KeyRow · object[]
required