Skip to main content
GET
Fetch an API key

Authorizations

X-Qanapi-Authorization
string
header
required

A machine credential, qk_ followed by its secret. Only a hash of the secret is stored, so a key is displayed exactly once, when it is created or rotated. A key reaches only the configurations it is linked to.

It may also be sent as Authorization: Bearer qk_..., which is recognised by the prefix.

Path Parameters

id
string<uuid>
required

The API key's id. Not the key itself, and not its prefix.

Response

The key, with its configurations and without its secret.

id
string<uuid>
required
user_id
string<uuid>
required

The owning user. Classification clearance for this key resolves through this user and their role.

name
string
required
prefix
string
required

The first twelve characters of the key, which is all that is stored in readable form. Useful for naming a key in a log without quoting the secret.

Example:

"qk_Q8oGyqBl3"

revoked_at
string<date-time> | null
required

Null while the key is usable. Revocation is permanent.

last_used_at
string<date-time> | null
required
created_at
string<date-time>
required
configurations
object[]

The configurations this key may reach. An empty array means none: the grant is explicit, so a newly minted key cannot touch data until somebody says which data it is for.

Absent, rather than empty, on the response to a rotation, which does not load them.