List API Keys

GET/web/v1/workspaces/{workspaceId}/api-keysJWT

Returns a paginated list of all API keys belonging to the specified workspace. Secret values are never included in list responses.

Authentication

Auth Chain: WEB Chain — requires Authorization: Bearer <jwt> Requires workspace OWNER role. These headers are injected by the system (frontend does nothing): X-PORTAL-ACCESS-CODE (Nginx), X-Request-Id (Gateway)

Request Parameters

Name	Type	Required	In	Description
workspaceId	string	Yes	path	Workspace business ID
page	integer	No	query	Page number (zero-based). Default: `0`
size	integer	No	query	Page size. Default: `20`
sort	string	No	query	Sort field and direction (e.g. `createdAt,desc`)

Success Response

Success200

{
  "version": "1.3.0",
  "timestamp": 1709337600000,
  "success": true,
  "code": "2000",
  "message": "SUCCESS",
  "data": {
    "content": [
      {
        "apiKeyId": "sk_live_abc123",
        "name": "Production Key",
        "status": "ACTIVE",
        "mode": "LIVE",
        "permissions": [
          "payment:read",
          "payment:write"
        ],
        "ipWhitelist": [
          "192.168.1.0/24"
        ],
        "createdAt": "2026-03-21T00:00:00Z",
        "lastUsedAt": "2026-03-21T12:00:00Z",
        "createdBy": "acc_owner123"
      }
    ],
    "totalElements": 1,
    "totalPages": 1,
    "size": 20,
    "number": 0
  }
}

Error Responses

Unauthorized401

{
  "success": false,
  "code": "4010",
  "message": "Invalid or expired token"
}

Forbidden — not workspace owner403

{
  "success": false,
  "code": "4030",
  "message": "Only workspace owner can manage API keys"
}

Notes

• API key secrets are never returned in list responses.
• Only workspace OWNERs can list API keys.