Skip to content
Fuse
Esc
↑↓navigate↵open⌘Jpreview

List API keys

Lists metadata for all keys, live and revoked, newest first. Never returns key secrets or hashes. api_keys is always an array — [] when empty, not null. Master-token only (403 with code unauthorized for API-key callers). Requires the Postgres-backed key store (DATABASE_URL); without it this route is not registered and returns 404 route_not_found.

GET/v1/api-keys
Authorization
AuthorizationBearer token · headerrequired
`Authorization: Bearer <token>` — either the static master token (`ORCH_AUTH_TOKEN`) or a revocable API key issued via /v1/api-keys (API keys require Postgres; without a database only the master token is accepted). Master-only surfaces (exec, attach, API key management) refuse API keys with 403. **Authentication can be disabled entirely.** When neither `ORCH_AUTH_TOKEN` nor an API key store (`DATABASE_URL`) is configured — the default local-development posture — the bearer middleware becomes a pass-through: every operation this document marks as secured is reachable with no credentials, requests carry no principal, and master-only surfaces therefore admit everyone. Never run that configuration on a reachable network; set `ORCH_REQUIRE_AUTH=true` to make the orchestrator refuse to start without a master token.
or
fuse_sessionAPI key · cookierequired
HttpOnly session cookie set by POST /login for browser callers. Consulted only when no Authorization header is present.
Responses
200Key metadata list.
api_keysAPIKey[]required
Always present; `[]` when there are no keys.
Show properties
Array of APIKey
idstringrequired
Public handle, prefix `ak_`. Used to revoke; not the secret.
labelstring
Optional operator memory aid. Omitted when empty.
created_atstring<date-time>required
last_used_atstring<date-time>
Omitted (not null) until the key first authenticates. Best-effort bump.
revoked_atstring<date-time>
Omitted (not null) while the key is live.
401Missing or invalid bearer token.
errorobjectrequired
Show properties
codestringrequired
Stable machine-readable code. `route_not_found` (404) means the URL matches no route this server exposes — usually a wrong host, port, or path prefix — as opposed to `not_found`, where the route exists but the resource does not. `forbidden` is emitted only by CIDR-allowlist rejections; master-only refusals (exec, attach, API key management) return 403 with code `unauthorized`.
Allowed:not_foundroute_not_foundconflictinvalid_argumentunauthorizedforbiddenunavailableinternalunimplemented
messagestringrequired
Human-readable description.
detailsobject
Optional stable, non-sensitive metadata (e.g. ids, counts). Omitted when empty.
403The caller authenticated, but not as the master operator. Master-only surfaces (exec, attach, API key management) refuse API keys; those 403 bodies carry code `unauthorized`. CIDR allowlist rejections also return 403 but with code `forbidden`.
errorobjectrequired
Show properties
codestringrequired
Stable machine-readable code. `route_not_found` (404) means the URL matches no route this server exposes — usually a wrong host, port, or path prefix — as opposed to `not_found`, where the route exists but the resource does not. `forbidden` is emitted only by CIDR-allowlist rejections; master-only refusals (exec, attach, API key management) return 403 with code `unauthorized`.
Allowed:not_foundroute_not_foundconflictinvalid_argumentunauthorizedforbiddenunavailableinternalunimplemented
messagestringrequired
Human-readable description.
detailsobject
Optional stable, non-sensitive metadata (e.g. ids, counts). Omitted when empty.
404No Postgres key store is configured, so this route is not registered; the fallback handler answers with code `route_not_found`.
errorobjectrequired
Show properties
codestringrequired
Stable machine-readable code. `route_not_found` (404) means the URL matches no route this server exposes — usually a wrong host, port, or path prefix — as opposed to `not_found`, where the route exists but the resource does not. `forbidden` is emitted only by CIDR-allowlist rejections; master-only refusals (exec, attach, API key management) return 403 with code `unauthorized`.
Allowed:not_foundroute_not_foundconflictinvalid_argumentunauthorizedforbiddenunavailableinternalunimplemented
messagestringrequired
Human-readable description.
detailsobject
Optional stable, non-sensitive metadata (e.g. ids, counts). Omitted when empty.
500Unexpected server error.
errorobjectrequired
Show properties
codestringrequired
Stable machine-readable code. `route_not_found` (404) means the URL matches no route this server exposes — usually a wrong host, port, or path prefix — as opposed to `not_found`, where the route exists but the resource does not. `forbidden` is emitted only by CIDR-allowlist rejections; master-only refusals (exec, attach, API key management) return 403 with code `unauthorized`.
Allowed:not_foundroute_not_foundconflictinvalid_argumentunauthorizedforbiddenunavailableinternalunimplemented
messagestringrequired
Human-readable description.
detailsobject
Optional stable, non-sensitive metadata (e.g. ids, counts). Omitted when empty.
Request
curl -X GET "http://localhost:8080/v1/api-keys" \
  -H "Authorization: Bearer YOUR_TOKEN"
Response
{
  "api_keys": [
    {
      "id": "string",
      "label": "string",
      "created_at": "2024-01-01T00:00:00Z",
      "last_used_at": "2024-01-01T00:00:00Z",
      "revoked_at": "2024-01-01T00:00:00Z"
    }
  ]
}