## Retrieve API Key (Admin API) ## Get API Key
The whole hunk
from line 1, old and new numbered
/
lines
from line 1
1---
2title: API Keys
3url: https://platform.claude.com/docs/en/api/beta/organization/api_keys
4---
5
16# API Keys
27
38## List API Keys
from line 53
4853
4954- `data: array of BetaAPIKey`
5055
56 - `type: "api_key"`
57
58 Object type.
59
60 For API Keys, this is always `"api_key"`.
61
62 default: api_key
63
5164 - `id: string`
5265
5366 ID of the API key.
from line 77
6477 creator is not recorded (legacy, workload-identity-federated, or
6578 system-created keys).
6679
67 - `id: string`
68
69 ID of the actor that created the object.
70
7180 - `type: "service_account" or "user"`
7281
7382 Type of the actor that created the object.
from line 85
7685
7786 - `"user"`
7887
88 - `id: string`
89
90 ID of the actor that created the object.
91
7992 - `expires_at: string or null`
8093
8194 RFC 3339 datetime string indicating when the API Key expires, or `null` if it never expires.
from line 121
108121
109122 - `BetaAPIKeyServiceAccountActor object`
110123
111 - `service_account_id: string`
112
113 ID of the Service Account the API key acts as.
114
115124 - `type: "service_account_actor"`
116125
117126 Principal type. Always `"service_account_actor"` for a Service Account.
from line 127
118127
119128 default: service_account_actor
120129
130 - `service_account_id: string`
131
132 ID of the Service Account the API key acts as.
133
121134 - `scope: BetaAPIKeyOrganizationScope or BetaAPIKeyWorkspaceScope`
122135
123136 Where the API key belongs: its Workspace (`{"type": "workspace", "workspace_id": "wrkspc_..."}`, with the Workspace's real ID even when it is the organization's default Workspace), or the organization (`{"type": "organization"}`) for a principal-bound API key that has no Workspace.
from line 167
154167
155168 - `"inactive"`
156169
157 - `type: "api_key"`
158
159 Object type.
160
161 For API Keys, this is always `"api_key"`.
162
163 default: api_key
164
165170 - `workspace_id: string or null`
166171
167172 **Deprecated**: Use `scope` instead. `workspace_id` is `null` both for an API key in the default Workspace and for a principal-bound API key that has no Workspace.
from line 227
222227}
223228```
224229
225## Get API Key
230## Retrieve API Key (Admin API)
226231
227232**GET** `/v1/organizations/api_keys/{api_key_id}`
228233
229Get API Key
234Retrieve information about a single API key in your organization, looked up by its ID. This Admin API endpoint requires an Admin API key, is intended for programmatic key management, and never returns the key's secret value. To view or create your own API keys, go to [API keys](https://platform.claude.com/settings/keys) in the Claude Console.
230235
231236### Path parameters
232237
from line 243
238243
239244- `BetaAPIKey object`
240245
246 - `type: "api_key"`
247
248 Object type.
249
250 For API Keys, this is always `"api_key"`.
251
252 default: api_key
253
241254 - `id: string`
242255
243256 ID of the API key.
from line 267
254267 creator is not recorded (legacy, workload-identity-federated, or
255268 system-created keys).
256269
257 - `id: string`
258
259 ID of the actor that created the object.
260
261270 - `type: "service_account" or "user"`
262271
263272 Type of the actor that created the object.
from line 275
266275
267276 - `"user"`
268277
278 - `id: string`
279
280 ID of the actor that created the object.
281
269282 - `expires_at: string or null`
270283
271284 RFC 3339 datetime string indicating when the API Key expires, or `null` if it never expires.
from line 311
298311
299312 - `BetaAPIKeyServiceAccountActor object`
300313
301 - `service_account_id: string`
302
303 ID of the Service Account the API key acts as.
304
305314 - `type: "service_account_actor"`
306315
307316 Principal type. Always `"service_account_actor"` for a Service Account.
from line 317
308317
309318 default: service_account_actor
310319
320 - `service_account_id: string`
321
322 ID of the Service Account the API key acts as.
323
311324 - `scope: BetaAPIKeyOrganizationScope or BetaAPIKeyWorkspaceScope`
312325
313326 Where the API key belongs: its Workspace (`{"type": "workspace", "workspace_id": "wrkspc_..."}`, with the Workspace's real ID even when it is the organization's default Workspace), or the organization (`{"type": "organization"}`) for a principal-bound API key that has no Workspace.
from line 357
344357
345358 - `"inactive"`
346359
347 - `type: "api_key"`
348
349 Object type.
350
351 For API Keys, this is always `"api_key"`.
352
353 default: api_key
354
355360 - `workspace_id: string or null`
356361
357362 **Deprecated**: Use `scope` instead. `workspace_id` is `null` both for an API key in the default Workspace and for a principal-bound API key that has no Workspace.
from line 432
427432
428433- `BetaAPIKey object`
429434
435 - `type: "api_key"`
436
437 Object type.
438
439 For API Keys, this is always `"api_key"`.
440
441 default: api_key
442
430443 - `id: string`
431444
432445 ID of the API key.
from line 456
443456 creator is not recorded (legacy, workload-identity-federated, or
444457 system-created keys).
445458
446 - `id: string`
447
448 ID of the actor that created the object.
449
450459 - `type: "service_account" or "user"`
451460
452461 Type of the actor that created the object.
from line 464
455464
456465 - `"user"`
457466
467 - `id: string`
468
469 ID of the actor that created the object.
470
458471 - `expires_at: string or null`
459472
460473 RFC 3339 datetime string indicating when the API Key expires, or `null` if it never expires.
from line 500
487500
488501 - `BetaAPIKeyServiceAccountActor object`
489502
490 - `service_account_id: string`
491
492 ID of the Service Account the API key acts as.
493
494503 - `type: "service_account_actor"`
495504
496505 Principal type. Always `"service_account_actor"` for a Service Account.
from line 506
497506
498507 default: service_account_actor
499508
509 - `service_account_id: string`
510
511 ID of the Service Account the API key acts as.
512
500513 - `scope: BetaAPIKeyOrganizationScope or BetaAPIKeyWorkspaceScope`
501514
502515 Where the API key belongs: its Workspace (`{"type": "workspace", "workspace_id": "wrkspc_..."}`, with the Workspace's real ID even when it is the organization's default Workspace), or the organization (`{"type": "organization"}`) for a principal-bound API key that has no Workspace.
from line 546
533546
534547 - `"inactive"`
535548
536 - `type: "api_key"`
537
538 Object type.
539
540 For API Keys, this is always `"api_key"`.
541
542 default: api_key
543
544549 - `workspace_id: string or null`
545550
546551 **Deprecated**: Use `scope` instead. `workspace_id` is `null` both for an API key in the default Workspace and for a principal-bound API key that has no Workspace.
from line 595
590595
591596- `BetaAPIKey object`
592597
598 - `type: "api_key"`
599
600 Object type.
601
602 For API Keys, this is always `"api_key"`.
603
604 default: api_key
605
593606 - `id: string`
594607
595608 ID of the API key.
from line 619
606619 creator is not recorded (legacy, workload-identity-federated, or
607620 system-created keys).
608621
609 - `id: string`
610
611 ID of the actor that created the object.
612
613622 - `type: "service_account" or "user"`
614623
615624 Type of the actor that created the object.
from line 627
618627
619628 - `"user"`
620629
630 - `id: string`
631
632 ID of the actor that created the object.
633
621634 - `expires_at: string or null`
622635
623636 RFC 3339 datetime string indicating when the API Key expires, or `null` if it never expires.
from line 663
650663
651664 - `BetaAPIKeyServiceAccountActor object`
652665
653 - `service_account_id: string`
654
655 ID of the Service Account the API key acts as.
656
657666 - `type: "service_account_actor"`
658667
659668 Principal type. Always `"service_account_actor"` for a Service Account.
from line 669
660669
661670 default: service_account_actor
662671
672 - `service_account_id: string`
673
674 ID of the Service Account the API key acts as.
675
663676 - `scope: BetaAPIKeyOrganizationScope or BetaAPIKeyWorkspaceScope`
664677
665678 Where the API key belongs: its Workspace (`{"type": "workspace", "workspace_id": "wrkspc_..."}`, with the Workspace's real ID even when it is the organization's default Workspace), or the organization (`{"type": "organization"}`) for a principal-bound API key that has no Workspace.
from line 709
696709
697710 - `"inactive"`
698711
699 - `type: "api_key"`
700
701 Object type.
702
703 For API Keys, this is always `"api_key"`.
704
705 default: api_key
706
707712 - `workspace_id: string or null`
708713
709714 **Deprecated**: Use `scope` instead. `workspace_id` is `null` both for an API key in the default Workspace and for a principal-bound API key that has no Workspace.
from line 719
714719
715720- `BetaAPIKeyCreatedBy object`
716721
717 - `id: string`
718
719 ID of the actor that created the object.
720
721722 - `type: "service_account" or "user"`
722723
723724 Type of the actor that created the object.
from line 727
726727
727728 - `"user"`
728729
730 - `id: string`
731
732 ID of the actor that created the object.
733
729734### Beta API Key Organization Scope
730735
731736- `BetaAPIKeyOrganizationScope object`
from line 745
740745
741746- `BetaAPIKeyServiceAccountActor object`
742747
743 - `service_account_id: string`
744
745 ID of the Service Account the API key acts as.
746
747748 - `type: "service_account_actor"`
748749
749750 Principal type. Always `"service_account_actor"` for a Service Account.
750751
751752 default: service_account_actor
753
754 - `service_account_id: string`
755
756 ID of the Service Account the API key acts as.
752757
753758### Beta API Key User Actor
754759