GET

/v1/organizations/{organizationId}/projects/{projectId}/environments/{environmentId}/service-principals/{principalId}/api-keys

List API Keys for an Environment-scoped ServicePrincipal

Return bounded safe credential metadata without any secret or hash.

Authentication

Send an API key as a Bearer token in the Authorization header.

Name	Location	Required	Description
`organizationId`	path	Yes	The Organization to address. `string`A Cantora Organization identifier, prefixed with `org_`. maximum length `64` pattern `^org_[\s\S]+$`
`projectId`	path	Yes	The Project to address. `string`A Cantora Project identifier, prefixed with `proj_`. maximum length `64` pattern `^proj_[\s\S]+$`
`environmentId`	path	Yes	The Environment to address. `string`A Cantora Environment identifier, prefixed with `env_`. maximum length `64` pattern `^env_[\s\S]+$`
`principalId`	path	Yes	The Principal to address. `string`A Cantora Principal identifier, prefixed with `principal_`. maximum length `64` pattern `^principal_[\s\S]+$`
`cursor`	query	No	The opaque continuation token returned by the preceding page. `string` maximum length `2048` minimum length `1` pattern `^[A-Za-z0-9_-]+$`
`limit`	query	No	The maximum number of resources to return, from 1 through 100. `string` pattern `^[+-]?\d*\.?\d+(?:[Ee][+-]?\d+)?$`

200ApiKeyPage

application/json

400The request path, headers, query, or JSON body did not satisfy the published schema

401Unauthorized

application/json

403Forbidden

application/json

404NotFound

application/json

object

itemsrequired: arrayThe resources in this page, in stable order.
Items
ApiKeyMetadataEncoded
nextCursorrequired: The opaque continuation token for the next page, or null after the final page.
Any of
string
maximum length 2048
minimum length 1
pattern ^[A-Za-z0-9_-]+$
null

object

_tagrequired: stringThe stable machine-readable error type.
allowed values "Unauthorized"
reasonrequired: stringA safe explanation of why the credential was rejected.

object

_tagrequired: stringThe stable machine-readable error type.
allowed values "Forbidden"
permissionrequired: stringThe permission required by the refused operation.

object

_tagrequired: stringThe stable machine-readable error type.
allowed values "NotFound"
resourcerequired: stringThe resource type relevant to the error.
idrequired: stringThe identifier supplied for the resource that was not found.

object

apiKeyIdrequired: stringThe identifier of the issued API key.
maximum length 64
pattern ^apikey_[\s\S]+$
principalIdrequired: stringThe Principal identifier.
maximum length 64
pattern ^principal_[\s\S]+$
creationIdempotencyKeyrequired: The caller-chosen issuance key that identifies this committed credential.
Any of
IdempotencyKey
null
namerequired: stringThe human-readable resource name.
displayPrefixrequired: stringThe non-secret leading characters used to distinguish this credential.
createdByPrincipalIdrequired: stringThe Principal that created this immutable record.
maximum length 64
pattern ^principal_[\s\S]+$
createdAtrequired: stringWhen the resource was created, in UTC.
format date-time
expiresAtrequired: stringWhen the resource expires, in UTC, or null when it does not expire.
format date-time
lastUsedAtrequired: Approximately when this credential was last presented, in UTC, or null before its first use.
format date-time
Any of
string
null
revokedAtrequired: When the resource was revoked, in UTC, or null while it remains active.
format date-time
Any of
string
null
revokedByPrincipalIdrequired: The Principal that revoked this resource, or null while it remains active.
Any of
stringA Cantora Principal identifier, prefixed with `principal_`.
maximum length 64
pattern ^principal_[\s\S]+$
null

stringA caller-chosen key of 1–200 visible ASCII characters that makes an identical request safe to retry.