Repository Public
1---2title: API Keys3url: https://platform.claude.com/docs/en/api/beta/organization/api_keys4---56# API Keys78## List API Keys910**GET** `/v1/organizations/api_keys`1112List API Keys1314### Query parameters1516- `after_id: optional string`1718 ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately after this object.1920- `before_id: optional string`2122 ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately before this object.2324- `created_by_user_id: optional string`2526 Filter by the ID of the User who created the object.2728- `limit: optional number`2930 Number of items to return per page.3132 Defaults to `20`. Ranges from `1` to `1000`.3334 default: 20, maximum: 1000, minimum: 13536- `status: optional "active" or "archived" or "expired" or "inactive"`3738 Filter by API key status.3940 - `"active"`4142 - `"archived"`4344 - `"expired"`4546 - `"inactive"`4748- `workspace_id: optional string`4950 Filter by Workspace ID.5152### Returns5354- `data: array of BetaAPIKey`5556 - `type: "api_key"`5758 Object type.5960 For API Keys, this is always `"api_key"`.6162 default: api_key6364 - `id: string`6566 ID of the API key.6768 - `created_at: string`6970 RFC 3339 datetime string indicating when the API Key was created.7172 format: date-time7374 - `created_by: BetaAPIKeyCreatedBy or null`7576 The ID and type of the actor that created the API key, or `null` when the77 creator is not recorded (legacy, workload-identity-federated, or78 system-created keys).7980 - `type: "service_account" or "user"`8182 Type of the actor that created the object.8384 - `"service_account"`8586 - `"user"`8788 - `id: string`8990 ID of the actor that created the object.9192 - `expires_at: string or null`9394 RFC 3339 datetime string indicating when the API Key expires, or `null` if it never expires.9596 format: date-time9798 - `name: string`99100 Name of the API key.101102 - `partial_key_hint: string or null`103104 Partially redacted hint for the API key.105106 - `principal: BetaAPIKeyUserActor or BetaAPIKeyServiceAccountActor or null`107108 The principal the API key acts as (a User or a Service Account), or `null` if the API key is not bound to a principal.109110 - `BetaAPIKeyUserActor object`111112 - `type: "user_actor"`113114 Principal type. Always `"user_actor"` for a User.115116 default: user_actor117118 - `user_id: string`119120 ID of the User the API key acts as.121122 - `BetaAPIKeyServiceAccountActor object`123124 - `type: "service_account_actor"`125126 Principal type. Always `"service_account_actor"` for a Service Account.127128 default: service_account_actor129130 - `service_account_id: string`131132 ID of the Service Account the API key acts as.133134 - `scope: BetaAPIKeyOrganizationScope or BetaAPIKeyWorkspaceScope`135136 Where the API key belongs: its Workspace (`{"type": "workspace", "workspace_id": "wrkspc_..."}`, with the Workspace's real ID even when it is the organization's default Workspace), or the organization (`{"type": "organization"}`) for a principal-bound API key that has no Workspace.137138 - `BetaAPIKeyOrganizationScope object`139140 - `type: "organization"`141142 Scope type. Always `"organization"`: the API key has no Workspace. Only a principal-bound API key can have this scope.143144 default: organization145146 - `BetaAPIKeyWorkspaceScope object`147148 - `type: "workspace"`149150 Scope type. Always `"workspace"`: the API key belongs to one Workspace.151152 default: workspace153154 - `workspace_id: string`155156 ID of the Workspace the API key belongs to. Unlike the deprecated top-level `workspace_id`, this is the Workspace's real ID even for the organization's default Workspace.157158 - `status: "active" or "archived" or "expired" or "inactive"`159160 Status of the API key.161162 - `"active"`163164 - `"archived"`165166 - `"expired"`167168 - `"inactive"`169170 - `workspace_id: string or null`171172 **Deprecated**: Use `scope` instead. `workspace_id` is `null` both for an API key in the default Workspace and for a principal-bound API key that has no Workspace.173174 Deprecated: use `scope` instead. ID of the Workspace associated with the API key, or `null` if the API key belongs to the default Workspace. Also `null` for a principal-bound API key that has no Workspace; `scope` tells the two apart.175176- `first_id: string or null`177178 First ID in the `data` list. Can be used as the `before_id` for the previous page.179180- `has_more: boolean`181182 Indicates if there are more results in the requested page direction.183184- `last_id: string or null`185186 Last ID in the `data` list. Can be used as the `after_id` for the next page.187188### Example189190```bash191curl https://api.anthropic.com/v1/organizations/api_keys \192 -H 'anthropic-version: 2023-06-01' \193 -H "X-Api-Key: $ANTHROPIC_API_KEY"194```195196#### Response (200)197198```json199{200 "data": [201 {202 "id": "apikey_01Rj2N8SVvo6BePZj99NhmiT",203 "created_at": "2024-10-30T23:58:27.427722Z",204 "created_by": {205 "id": "user_01WCz1FkmYMm4gnmykNKUu3Q",206 "type": "user"207 },208 "expires_at": "2024-10-30T23:58:27.427722Z",209 "name": "Developer Key",210 "partial_key_hint": "sk-ant-api03-R2D...igAA",211 "principal": {212 "type": "user_actor",213 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"214 },215 "scope": {216 "type": "workspace",217 "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"218 },219 "status": "active",220 "type": "api_key",221 "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"222 }223 ],224 "first_id": "first_id",225 "has_more": true,226 "last_id": "last_id"227}228```229230## Retrieve API Key (Admin API)231232**GET** `/v1/organizations/api_keys/{api_key_id}`233234Retrieve information about a single API key in your organization, looked up by its ID. This Admin API endpoint requires an Admin API key, is intended for programmatic key management, and never returns the key's secret value. To view or create your own API keys, go to [API keys](https://platform.claude.com/settings/keys) in the Claude Console.235236### Path parameters237238- `api_key_id: string`239240 ID of the API key.241242### Returns243244- `BetaAPIKey object`245246 - `type: "api_key"`247248 Object type.249250 For API Keys, this is always `"api_key"`.251252 default: api_key253254 - `id: string`255256 ID of the API key.257258 - `created_at: string`259260 RFC 3339 datetime string indicating when the API Key was created.261262 format: date-time263264 - `created_by: BetaAPIKeyCreatedBy or null`265266 The ID and type of the actor that created the API key, or `null` when the267 creator is not recorded (legacy, workload-identity-federated, or268 system-created keys).269270 - `type: "service_account" or "user"`271272 Type of the actor that created the object.273274 - `"service_account"`275276 - `"user"`277278 - `id: string`279280 ID of the actor that created the object.281282 - `expires_at: string or null`283284 RFC 3339 datetime string indicating when the API Key expires, or `null` if it never expires.285286 format: date-time287288 - `name: string`289290 Name of the API key.291292 - `partial_key_hint: string or null`293294 Partially redacted hint for the API key.295296 - `principal: BetaAPIKeyUserActor or BetaAPIKeyServiceAccountActor or null`297298 The principal the API key acts as (a User or a Service Account), or `null` if the API key is not bound to a principal.299300 - `BetaAPIKeyUserActor object`301302 - `type: "user_actor"`303304 Principal type. Always `"user_actor"` for a User.305306 default: user_actor307308 - `user_id: string`309310 ID of the User the API key acts as.311312 - `BetaAPIKeyServiceAccountActor object`313314 - `type: "service_account_actor"`315316 Principal type. Always `"service_account_actor"` for a Service Account.317318 default: service_account_actor319320 - `service_account_id: string`321322 ID of the Service Account the API key acts as.323324 - `scope: BetaAPIKeyOrganizationScope or BetaAPIKeyWorkspaceScope`325326 Where the API key belongs: its Workspace (`{"type": "workspace", "workspace_id": "wrkspc_..."}`, with the Workspace's real ID even when it is the organization's default Workspace), or the organization (`{"type": "organization"}`) for a principal-bound API key that has no Workspace.327328 - `BetaAPIKeyOrganizationScope object`329330 - `type: "organization"`331332 Scope type. Always `"organization"`: the API key has no Workspace. Only a principal-bound API key can have this scope.333334 default: organization335336 - `BetaAPIKeyWorkspaceScope object`337338 - `type: "workspace"`339340 Scope type. Always `"workspace"`: the API key belongs to one Workspace.341342 default: workspace343344 - `workspace_id: string`345346 ID of the Workspace the API key belongs to. Unlike the deprecated top-level `workspace_id`, this is the Workspace's real ID even for the organization's default Workspace.347348 - `status: "active" or "archived" or "expired" or "inactive"`349350 Status of the API key.351352 - `"active"`353354 - `"archived"`355356 - `"expired"`357358 - `"inactive"`359360 - `workspace_id: string or null`361362 **Deprecated**: Use `scope` instead. `workspace_id` is `null` both for an API key in the default Workspace and for a principal-bound API key that has no Workspace.363364 Deprecated: use `scope` instead. ID of the Workspace associated with the API key, or `null` if the API key belongs to the default Workspace. Also `null` for a principal-bound API key that has no Workspace; `scope` tells the two apart.365366### Example367368```bash369curl https://api.anthropic.com/v1/organizations/api_keys/$API_KEY_ID \370 -H 'anthropic-version: 2023-06-01' \371 -H "X-Api-Key: $ANTHROPIC_API_KEY"372```373374#### Response (200)375376```json377{378 "id": "apikey_01Rj2N8SVvo6BePZj99NhmiT",379 "created_at": "2024-10-30T23:58:27.427722Z",380 "created_by": {381 "id": "user_01WCz1FkmYMm4gnmykNKUu3Q",382 "type": "user"383 },384 "expires_at": "2024-10-30T23:58:27.427722Z",385 "name": "Developer Key",386 "partial_key_hint": "sk-ant-api03-R2D...igAA",387 "principal": {388 "type": "user_actor",389 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"390 },391 "scope": {392 "type": "workspace",393 "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"394 },395 "status": "active",396 "type": "api_key",397 "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"398}399```400401## Update API Key402403**POST** `/v1/organizations/api_keys/{api_key_id}`404405Update API Key406407### Path parameters408409- `api_key_id: string`410411 ID of the API key.412413### Body parameters414415- `name: optional string or null`416417 Name of the API key.418419 maxLength: 500, minLength: 1420421- `status: optional "active" or "archived" or "inactive" or null`422423 Status of the API key.424425 - `"active"`426427 - `"archived"`428429 - `"inactive"`430431### Returns432433- `BetaAPIKey object`434435 - `type: "api_key"`436437 Object type.438439 For API Keys, this is always `"api_key"`.440441 default: api_key442443 - `id: string`444445 ID of the API key.446447 - `created_at: string`448449 RFC 3339 datetime string indicating when the API Key was created.450451 format: date-time452453 - `created_by: BetaAPIKeyCreatedBy or null`454455 The ID and type of the actor that created the API key, or `null` when the456 creator is not recorded (legacy, workload-identity-federated, or457 system-created keys).458459 - `type: "service_account" or "user"`460461 Type of the actor that created the object.462463 - `"service_account"`464465 - `"user"`466467 - `id: string`468469 ID of the actor that created the object.470471 - `expires_at: string or null`472473 RFC 3339 datetime string indicating when the API Key expires, or `null` if it never expires.474475 format: date-time476477 - `name: string`478479 Name of the API key.480481 - `partial_key_hint: string or null`482483 Partially redacted hint for the API key.484485 - `principal: BetaAPIKeyUserActor or BetaAPIKeyServiceAccountActor or null`486487 The principal the API key acts as (a User or a Service Account), or `null` if the API key is not bound to a principal.488489 - `BetaAPIKeyUserActor object`490491 - `type: "user_actor"`492493 Principal type. Always `"user_actor"` for a User.494495 default: user_actor496497 - `user_id: string`498499 ID of the User the API key acts as.500501 - `BetaAPIKeyServiceAccountActor object`502503 - `type: "service_account_actor"`504505 Principal type. Always `"service_account_actor"` for a Service Account.506507 default: service_account_actor508509 - `service_account_id: string`510511 ID of the Service Account the API key acts as.512513 - `scope: BetaAPIKeyOrganizationScope or BetaAPIKeyWorkspaceScope`514515 Where the API key belongs: its Workspace (`{"type": "workspace", "workspace_id": "wrkspc_..."}`, with the Workspace's real ID even when it is the organization's default Workspace), or the organization (`{"type": "organization"}`) for a principal-bound API key that has no Workspace.516517 - `BetaAPIKeyOrganizationScope object`518519 - `type: "organization"`520521 Scope type. Always `"organization"`: the API key has no Workspace. Only a principal-bound API key can have this scope.522523 default: organization524525 - `BetaAPIKeyWorkspaceScope object`526527 - `type: "workspace"`528529 Scope type. Always `"workspace"`: the API key belongs to one Workspace.530531 default: workspace532533 - `workspace_id: string`534535 ID of the Workspace the API key belongs to. Unlike the deprecated top-level `workspace_id`, this is the Workspace's real ID even for the organization's default Workspace.536537 - `status: "active" or "archived" or "expired" or "inactive"`538539 Status of the API key.540541 - `"active"`542543 - `"archived"`544545 - `"expired"`546547 - `"inactive"`548549 - `workspace_id: string or null`550551 **Deprecated**: Use `scope` instead. `workspace_id` is `null` both for an API key in the default Workspace and for a principal-bound API key that has no Workspace.552553 Deprecated: use `scope` instead. ID of the Workspace associated with the API key, or `null` if the API key belongs to the default Workspace. Also `null` for a principal-bound API key that has no Workspace; `scope` tells the two apart.554555### Example556557```bash558curl https://api.anthropic.com/v1/organizations/api_keys/$API_KEY_ID \559 -H 'Content-Type: application/json' \560 -H 'anthropic-version: 2023-06-01' \561 -H "X-Api-Key: $ANTHROPIC_API_KEY" \562 -d '{}'563```564565#### Response (200)566567```json568{569 "id": "apikey_01Rj2N8SVvo6BePZj99NhmiT",570 "created_at": "2024-10-30T23:58:27.427722Z",571 "created_by": {572 "id": "user_01WCz1FkmYMm4gnmykNKUu3Q",573 "type": "user"574 },575 "expires_at": "2024-10-30T23:58:27.427722Z",576 "name": "Developer Key",577 "partial_key_hint": "sk-ant-api03-R2D...igAA",578 "principal": {579 "type": "user_actor",580 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"581 },582 "scope": {583 "type": "workspace",584 "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"585 },586 "status": "active",587 "type": "api_key",588 "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"589}590```591592## Domain types593594### Beta API Key595596- `BetaAPIKey object`597598 - `type: "api_key"`599600 Object type.601602 For API Keys, this is always `"api_key"`.603604 default: api_key605606 - `id: string`607608 ID of the API key.609610 - `created_at: string`611612 RFC 3339 datetime string indicating when the API Key was created.613614 format: date-time615616 - `created_by: BetaAPIKeyCreatedBy or null`617618 The ID and type of the actor that created the API key, or `null` when the619 creator is not recorded (legacy, workload-identity-federated, or620 system-created keys).621622 - `type: "service_account" or "user"`623624 Type of the actor that created the object.625626 - `"service_account"`627628 - `"user"`629630 - `id: string`631632 ID of the actor that created the object.633634 - `expires_at: string or null`635636 RFC 3339 datetime string indicating when the API Key expires, or `null` if it never expires.637638 format: date-time639640 - `name: string`641642 Name of the API key.643644 - `partial_key_hint: string or null`645646 Partially redacted hint for the API key.647648 - `principal: BetaAPIKeyUserActor or BetaAPIKeyServiceAccountActor or null`649650 The principal the API key acts as (a User or a Service Account), or `null` if the API key is not bound to a principal.651652 - `BetaAPIKeyUserActor object`653654 - `type: "user_actor"`655656 Principal type. Always `"user_actor"` for a User.657658 default: user_actor659660 - `user_id: string`661662 ID of the User the API key acts as.663664 - `BetaAPIKeyServiceAccountActor object`665666 - `type: "service_account_actor"`667668 Principal type. Always `"service_account_actor"` for a Service Account.669670 default: service_account_actor671672 - `service_account_id: string`673674 ID of the Service Account the API key acts as.675676 - `scope: BetaAPIKeyOrganizationScope or BetaAPIKeyWorkspaceScope`677678 Where the API key belongs: its Workspace (`{"type": "workspace", "workspace_id": "wrkspc_..."}`, with the Workspace's real ID even when it is the organization's default Workspace), or the organization (`{"type": "organization"}`) for a principal-bound API key that has no Workspace.679680 - `BetaAPIKeyOrganizationScope object`681682 - `type: "organization"`683684 Scope type. Always `"organization"`: the API key has no Workspace. Only a principal-bound API key can have this scope.685686 default: organization687688 - `BetaAPIKeyWorkspaceScope object`689690 - `type: "workspace"`691692 Scope type. Always `"workspace"`: the API key belongs to one Workspace.693694 default: workspace695696 - `workspace_id: string`697698 ID of the Workspace the API key belongs to. Unlike the deprecated top-level `workspace_id`, this is the Workspace's real ID even for the organization's default Workspace.699700 - `status: "active" or "archived" or "expired" or "inactive"`701702 Status of the API key.703704 - `"active"`705706 - `"archived"`707708 - `"expired"`709710 - `"inactive"`711712 - `workspace_id: string or null`713714 **Deprecated**: Use `scope` instead. `workspace_id` is `null` both for an API key in the default Workspace and for a principal-bound API key that has no Workspace.715716 Deprecated: use `scope` instead. ID of the Workspace associated with the API key, or `null` if the API key belongs to the default Workspace. Also `null` for a principal-bound API key that has no Workspace; `scope` tells the two apart.717718### Beta API Key Created By719720- `BetaAPIKeyCreatedBy object`721722 - `type: "service_account" or "user"`723724 Type of the actor that created the object.725726 - `"service_account"`727728 - `"user"`729730 - `id: string`731732 ID of the actor that created the object.733734### Beta API Key Organization Scope735736- `BetaAPIKeyOrganizationScope object`737738 - `type: "organization"`739740 Scope type. Always `"organization"`: the API key has no Workspace. Only a principal-bound API key can have this scope.741742 default: organization743744### Beta API Key Service Account Actor745746- `BetaAPIKeyServiceAccountActor object`747748 - `type: "service_account_actor"`749750 Principal type. Always `"service_account_actor"` for a Service Account.751752 default: service_account_actor753754 - `service_account_id: string`755756 ID of the Service Account the API key acts as.757758### Beta API Key User Actor759760- `BetaAPIKeyUserActor object`761762 - `type: "user_actor"`763764 Principal type. Always `"user_actor"` for a User.765766 default: user_actor767768 - `user_id: string`769770 ID of the User the API key acts as.771772### Beta API Key Workspace Scope773774- `BetaAPIKeyWorkspaceScope object`775776 - `type: "workspace"`777778 Scope type. Always `"workspace"`: the API key belongs to one Workspace.779780 default: workspace781782 - `workspace_id: string`783784 ID of the Workspace the API key belongs to. Unlike the deprecated top-level `workspace_id`, this is the Workspace's real ID even for the organization's default Workspace.785