`GET /auth/api-keys`

List API keys for the current org. Secrets are never returned, just metadata. Any member can call this. Each row carries a can_revoke flag computed for the caller (owner/admin can revoke any key; everyone else can only revoke keys they created themselves) so dashboards can disable the revoke affordance without a probe request.

Query parameters

Name	Values	Default	Notes
`status`	`active` \| `revoked` \| `all`	`active`	`active` excludes revoked and expired keys. `revoked` returns only revoked.

Response 200

{
  "api_keys": [
    {
      "id": "k_2f10…",
      "org_id": "0a2a…",
      "prefix": "seismic_prod_abc12…",
      "label": "ci-pipeline",
      "created_by": "9d11…",
      "created_at": "2026-04-29T15:00:00Z",
      "expires_at": "2026-05-29T15:00:00Z",
      "last_used_at": "2026-04-30T09:14:22Z",
      "revoked_at": null,
      "ip_allowlist": [
        "10.0.0.0/8"
      ],
      "access": "full",
      "can_revoke": true
    },
    {
      "id": "k_8b3a…",
      "org_id": "0a2a…",
      "prefix": "seismic_prod_xyz78…",
      "label": "old-ci",
      "created_by": "9d11…",
      "created_at": "2026-04-12T12:00:00Z",
      "expires_at": "2026-05-12T12:00:00Z",
      "last_used_at": null,
      "revoked_at": "2026-04-25T14:00:00Z",
      "ip_allowlist": [],
      "access": "read_only",
      "can_revoke": false
    }
  ]
}

See ApiKey.

Example

# Default: only active (not revoked, not expired) keys:
curl "$SEISMIC_ORCHESTRATION_URL/v0/auth/api-keys" \
  -H "Api-Key: $SEISMIC_ORCHESTRATION_API_KEY"
 
# Include revoked + expired:
curl "$SEISMIC_ORCHESTRATION_URL/v0/auth/api-keys?status=all" \
  -H "Api-Key: $SEISMIC_ORCHESTRATION_API_KEY"