Get Caller API Key by ID (alternate path)

GET /admin/v1/apikeys/{id}

Get Caller API Key by ID (alternate path)

Alternate spelling of /admin/v1/api_keys/{id}. Requests and responses are identical on both paths. Get a caller API key by ID with plaintext credentials redacted.

Parameters

• id (path, string, required): Caller API key resource ID, as assigned by the active resource source (a UUIDv5 derived from the entry name in file mode; the etcd key's ID segment otherwise).

Responses

• 200: OK
• id (string, required): Resource ID, as assigned by the active resource source.
• revision (integer, required): Monotonic resource revision: the etcd mod_revision of the entry, or the load generation in file mode.
• value (object, required): Stored caller API key configuration with plaintext credentials redacted.
• allOf variant 1
• value.allowed_agents (array,null, optional): A2A agents this key may reach, named by their registered names. Entries are matched as single-* globs: "*" grants every agent and an entry without a * matches one agent exactly. When omitted, set to null, or set to an empty list, the key has no A2A agent access — access is granted explicitly.
• value.allowed_models (array, required): Model aliases this caller API key may use.
• value.disabled (boolean, optional): Administratively disabled. A disabled key is rejected with 401 until it is enabled again; the key itself is preserved.
• value.expires_at (string,null, optional): RFC 3339 timestamp after which the key stops authenticating. Requests presenting an expired key are rejected with 401. When omitted or set to null, the key never expires.
• value.key_hash (string, required): SHA-256 hash of the caller-facing plaintext key.
• value.mcp_access (object,null, optional): This key's own layer of the MCP tool ACL, as namespaced <server>__<tool> glob patterns. Intersected with the environment and team MCP access policies: every present layer must allow a tool and no layer may deny it. When omitted the key adds no constraint of its own; with no layer present anywhere the grant is empty.
• value.mcp_access.allow (array, required): Namespaced <server>__<tool> glob patterns this key allows, intersected with the environment and team layers.
• value.mcp_access.deny (array, optional): Namespaced <server>__<tool> glob patterns subtracted from this key's effective grant. Deny always wins.
• value.rate_limit (object, optional): Request, token, and concurrency limits for this key.
• allOf variant 1
• value.rate_limit.concurrency (integer,null, optional): Max concurrent in-flight requests.
• value.rate_limit.rpd (integer,null, optional): Requests per 86,400-second window.
• value.rate_limit.rph (integer,null, optional): Requests per 3,600-second window. There is no per-hour token limit field.
• value.rate_limit.rpm (integer,null, optional): Requests per 60-second window.
• value.rate_limit.rps (integer,null, optional): Requests per 1-second window. There is no per-second token limit field.
• value.rate_limit.tpd (integer,null, optional): Tokens per 86,400-second window.
• value.rate_limit.tpm (integer,null, optional): Tokens per 60-second window.
• 401: Missing or invalid admin key
• error_msg (string, required): Human-readable error message.
• 404: Resource not found Response fields (application/json): identical to GET /admin/v1/apikeys/{id}, response 401 above.
• 500: Configuration store operation failed Response fields (application/json): identical to GET /admin/v1/apikeys/{id}, response 401 above.

cURL

curl -X GET 'http://127.0.0.1:3001/admin/v1/apikeys/{id}'