List API keys
curl --request GET \
--url https://api.get-exo.com/v1/keys \
--header 'X-Exo-API-Key: <api-key>'import requests
url = "https://api.get-exo.com/v1/keys"
headers = {"X-Exo-API-Key": "<api-key>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {'X-Exo-API-Key': '<api-key>'}};
fetch('https://api.get-exo.com/v1/keys', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));{
"keys": [
{
"id": "<string>",
"status": "<string>",
"createdAt": "<string>",
"label": "<string>",
"lastUsedAt": "<string>"
}
]
}{
"code": "<string>",
"detail": "<string>",
"status": 123,
"title": "<string>",
"type": "<string>",
"documentationUrl": "<string>",
"errors": [
{
"code": "<string>",
"field": "<string>",
"message": "<string>",
"pointer": "<string>"
}
],
"requestId": "",
"suggestedAction": "<string>"
}{
"code": "<string>",
"detail": "<string>",
"status": 123,
"title": "<string>",
"type": "<string>",
"documentationUrl": "<string>",
"errors": [
{
"code": "<string>",
"field": "<string>",
"message": "<string>",
"pointer": "<string>"
}
],
"requestId": "",
"suggestedAction": "<string>"
}{
"code": "<string>",
"detail": "<string>",
"status": 123,
"title": "<string>",
"type": "<string>",
"documentationUrl": "<string>",
"errors": [
{
"code": "<string>",
"field": "<string>",
"message": "<string>",
"pointer": "<string>"
}
],
"requestId": "",
"suggestedAction": "<string>"
}{
"code": "<string>",
"detail": "<string>",
"status": 123,
"title": "<string>",
"type": "<string>",
"documentationUrl": "<string>",
"errors": [
{
"code": "<string>",
"field": "<string>",
"message": "<string>",
"pointer": "<string>"
}
],
"requestId": "",
"suggestedAction": "<string>"
}{
"code": "<string>",
"detail": "<string>",
"status": 123,
"title": "<string>",
"type": "<string>",
"documentationUrl": "<string>",
"errors": [
{
"code": "<string>",
"field": "<string>",
"message": "<string>",
"pointer": "<string>"
}
],
"requestId": "",
"suggestedAction": "<string>"
}{
"code": "<string>",
"detail": "<string>",
"status": 123,
"title": "<string>",
"type": "<string>",
"documentationUrl": "<string>",
"errors": [
{
"code": "<string>",
"field": "<string>",
"message": "<string>",
"pointer": "<string>"
}
],
"requestId": "",
"suggestedAction": "<string>"
}{
"code": "<string>",
"detail": "<string>",
"status": 123,
"title": "<string>",
"type": "<string>",
"documentationUrl": "<string>",
"errors": [
{
"code": "<string>",
"field": "<string>",
"message": "<string>",
"pointer": "<string>"
}
],
"requestId": "",
"suggestedAction": "<string>"
}{
"code": "<string>",
"detail": "<string>",
"status": 123,
"title": "<string>",
"type": "<string>",
"documentationUrl": "<string>",
"errors": [
{
"code": "<string>",
"field": "<string>",
"message": "<string>",
"pointer": "<string>"
}
],
"requestId": "",
"suggestedAction": "<string>"
}Account and platform
List API keys
List the caller’s API keys (active and revoked), newest first.
GET
/
v1
/
keys
List API keys
curl --request GET \
--url https://api.get-exo.com/v1/keys \
--header 'X-Exo-API-Key: <api-key>'import requests
url = "https://api.get-exo.com/v1/keys"
headers = {"X-Exo-API-Key": "<api-key>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {'X-Exo-API-Key': '<api-key>'}};
fetch('https://api.get-exo.com/v1/keys', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));{
"keys": [
{
"id": "<string>",
"status": "<string>",
"createdAt": "<string>",
"label": "<string>",
"lastUsedAt": "<string>"
}
]
}{
"code": "<string>",
"detail": "<string>",
"status": 123,
"title": "<string>",
"type": "<string>",
"documentationUrl": "<string>",
"errors": [
{
"code": "<string>",
"field": "<string>",
"message": "<string>",
"pointer": "<string>"
}
],
"requestId": "",
"suggestedAction": "<string>"
}{
"code": "<string>",
"detail": "<string>",
"status": 123,
"title": "<string>",
"type": "<string>",
"documentationUrl": "<string>",
"errors": [
{
"code": "<string>",
"field": "<string>",
"message": "<string>",
"pointer": "<string>"
}
],
"requestId": "",
"suggestedAction": "<string>"
}{
"code": "<string>",
"detail": "<string>",
"status": 123,
"title": "<string>",
"type": "<string>",
"documentationUrl": "<string>",
"errors": [
{
"code": "<string>",
"field": "<string>",
"message": "<string>",
"pointer": "<string>"
}
],
"requestId": "",
"suggestedAction": "<string>"
}{
"code": "<string>",
"detail": "<string>",
"status": 123,
"title": "<string>",
"type": "<string>",
"documentationUrl": "<string>",
"errors": [
{
"code": "<string>",
"field": "<string>",
"message": "<string>",
"pointer": "<string>"
}
],
"requestId": "",
"suggestedAction": "<string>"
}{
"code": "<string>",
"detail": "<string>",
"status": 123,
"title": "<string>",
"type": "<string>",
"documentationUrl": "<string>",
"errors": [
{
"code": "<string>",
"field": "<string>",
"message": "<string>",
"pointer": "<string>"
}
],
"requestId": "",
"suggestedAction": "<string>"
}{
"code": "<string>",
"detail": "<string>",
"status": 123,
"title": "<string>",
"type": "<string>",
"documentationUrl": "<string>",
"errors": [
{
"code": "<string>",
"field": "<string>",
"message": "<string>",
"pointer": "<string>"
}
],
"requestId": "",
"suggestedAction": "<string>"
}{
"code": "<string>",
"detail": "<string>",
"status": 123,
"title": "<string>",
"type": "<string>",
"documentationUrl": "<string>",
"errors": [
{
"code": "<string>",
"field": "<string>",
"message": "<string>",
"pointer": "<string>"
}
],
"requestId": "",
"suggestedAction": "<string>"
}{
"code": "<string>",
"detail": "<string>",
"status": 123,
"title": "<string>",
"type": "<string>",
"documentationUrl": "<string>",
"errors": [
{
"code": "<string>",
"field": "<string>",
"message": "<string>",
"pointer": "<string>"
}
],
"requestId": "",
"suggestedAction": "<string>"
}Plaintext is never returned;
Every error is an RFC 9457
id is the key’s SHA-256 hash, which cannot
authenticate and is the id DELETE /v1/keys/{id} takes. Rows are scoped to
the calling user within their organization; an admin key sees its own keys,
not the whole org’s (org-wide listing waits for scoped keys).
Authorization
This route accepts any authenticated Exo API key and checks no additional scope. A missing or invalid credential returns 401authentication_error. A valid credential without the scope returns 403 permission_denied, and the problem body names the exact scope required.
Headers
These are request conventions the contract does not declare as parameters, so they do not appear in the schema tables below.| Header | Applies | What it does |
|---|---|---|
X-Exo-API-Key | Required | Your Exo API key, exo_<env>_<token>. Authorization: Bearer exo_... is accepted as an alternate. |
X-Exo-Subject | Not applicable | This route is not subject-scoped. |
Idempotency-Key | Not applicable | The replay engine covers POST requests only. |
X-Request-Id | Response | Returned on every response, including 204s. Quote it in a support request. |
Success responses
| Status | Meaning |
|---|---|
200 | Successful Response |
Errors
| Status | Code | When |
|---|---|---|
400 | invalid_request | Malformed request, for example an invalid cursor. |
401 | authentication_error | Missing or invalid credentials. |
403 | permission_denied | Missing scope, or an unprovisioned subject selector. |
404 | not_found | The resource does not exist, or is not visible to this caller. |
409 | conflict | A conflict with the current state of the resource. |
422 | validation_error | The request was understood but failed field validation. |
429 | rate_limit_exceeded | Rate limit exceeded. Retry after the Retry-After interval. |
503 | service_degraded | A dependency is temporarily unavailable. Safe to retry. |
application/problem+json body carrying a stable code, a requestId, and a suggestedAction where Exo has one. See Errors.⌘I