List API keys

GET/api/v1/api-keys

Requires anorganization API keywith the scopeaccount:read

The keys your organization holds, with their prefixes, scopes and last use.

Listing is available to a key; creating and revoking are not. A leaked key that could mint its own replacement would outlive the revocation of the key that leaked, so those stay in the dashboard on purpose.

Request

GET/api/v1/api-keys

curl -X GET 'https://app.mailyte.com/api/v1/api-keys' \
  -H 'Authorization: Bearer mk_live_YOUR_API_KEY'

const response = await fetch('https://app.mailyte.com/api/v1/api-keys', {
  method: 'GET',
  headers: {
    Authorization: 'Bearer mk_live_YOUR_API_KEY',
  },
});
const { data } = await response.json();

import requests
response = requests.get(
    "https://app.mailyte.com/api/v1/api-keys",
    headers={"Authorization": "Bearer mk_live_YOUR_API_KEY"},
)
data = response.json()["data"]

<?php

$response = Http::withToken('mk_live_YOUR_API_KEY')
    ->get('https://app.mailyte.com/api/v1/api-keys');

$data = $response->json('data');

require "net/http"
require "json"
uri = URI("https://app.mailyte.com/api/v1/api-keys")
request = Net::HTTP::Get.new(uri)
request["Authorization"] = "Bearer mk_live_YOUR_API_KEY"
response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) { |http| http.request(request) }

The key names its own organization, so no X-Organization-ID header is needed.

Response

Success.

dataarray<object>
- objectstringapi_key
- idstring
  Unique identifier for the key.
- namestring
  Your name for the key.
- prefixstring
  The start of the key, safe to log and show: mk_live_ (or mk_test_ for a test key) and 8 more characters. Use it to tell your keys apart. A key starting mk_dead_ is an old key we revoked; see revoked_reason.
- scopesarray<any>
  What this key may do, as resource:action strings. An empty list allows nothing. Scopes cannot be changed later; make a new key instead.
- modestringlive | test
  test (prefix mk_test_) for a test key: messages are built exactly as live ones would be, then stored in your Sandbox instead of being delivered. They are not in your live event log and use no credits. Use one in CI. The mode cannot be changed after the key is made.
- statestringactive | expired | revoked
  Whether the key works. Only active does. A key past its expiry reads expired.
- revoked_reasonstring
  Why we revoked the key, when we did. Null when the key is not revoked, or you revoked it yourself.
- ip_allowlistobject
  Enforced at authentication time. enabled: false with a populated list is a configured allowlist that is currently off, not a contradiction.
  - enabledboolean
  - addressesarray<string>
    IPv4/IPv6 addresses or CIDR ranges.
- last_usedobject
  When and where the key was last used. This is updated at most once a minute, so it can be up to a minute behind.
  - atstring
    When the key was last used, in ISO 8601 UTC. Null means it has never been used.
  - ipstring
    The IP address the key was last used from. Use it to spot a leaked key used from somewhere you do not know. Null when the key was never used, or the address could not be read.
- expires_atstring
  When the key stops working, in ISO 8601 UTC. Null means it never expires. Read state to see whether the key works now.
- created_atstring
  ISO 8601 UTC.

Returned inside the standard envelope.

Errors

Status	When
`401`	The API key is missing, unknown, revoked or expired. All four answer identically, on purpose: distinguishing them would confirm which keys exist.
`403`	The key is valid but may not do this: it lacks the required scope, its IP allowlist does not include you, or this endpoint does not accept API keys.
`404`	No such resource in this organization.
`422`	The request was understood but the values were not acceptable.
`429`	Too many requests, or the organization has spent its sending allowance. `Retry-After` says how long to wait.

Every status, with what causes it and what to do, is on the error reference.