> ## Documentation Index > Fetch the complete documentation index at: https://docs.boat.dev/llms.txt > Use this file to discover all available pages before exploring further. # List API keys > Lists API key metadata only. Raw key secrets are not returned after creation/rotation. Results include expiry and scope. A restricted API-key caller receives `apiKeys: []`; only an unrestricted account key or browser/CLI session receives the account inventory. Bearer header is unchanged; scope lives on the key. ## OpenAPI ````yaml openapi/box-v1.yaml GET /api-keys openapi: 3.1.0 info: title: Boat Public API v1 version: 1.0.0 description: > Public JSON API for creating, operating, prompting, observing, and exposing Boat sandboxes from backend services, CI jobs, hosted workers, and Boat automation products. The v1 reference intentionally documents the developer integration surface only. Dashboard billing actions are not part of v1. servers: - url: https://ascii.dev/api/box/v1 security: - BoxBearerAuth: [] tags: - name: Box description: >- Unified Boat account, setup, lifecycle, prompting, event history, desktop access, and SSH operations. paths: /api-keys: get: tags: - Box summary: List API keys description: >- Lists API key metadata only. Raw key secrets are not returned after creation/rotation. Results include expiry and scope. A restricted API-key caller receives `apiKeys: []`; only an unrestricted account key or browser/CLI session receives the account inventory. Bearer header is unchanged; scope lives on the key. operationId: apiKeys responses: '200': description: API key metadata. content: application/json: schema: $ref: '#/components/schemas/ApiKeysResponse' examples: keys: value: ok: true type: api_key.list apiKeys: - id: sak_123 name: Production worker credentialLane: scoped-v1 keyPrefix: box_live keyLastFour: 9abc sandboxId: null createdAt: '2026-05-31T12:00:00Z' lastUsedAt: null usage: requests: 1842 windowDays: 30 resources: total: 3 boxes: 2 agents: 1 expiresAt: '2026-11-21T12:00:00Z' expired: false expiringSoon: false scope: actions: - '*' boxes: '*' environments: '*' grandfathered: false catalog: actions: - box.read - exec - '*' presets: read-only: - box.read - file.read - snapshot.read - environment.read - account.read defaultTtl: 90d maxTtl: 365d scopedCreationEnabled: true '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' components: schemas: ApiKeysResponse: allOf: - $ref: '#/components/schemas/SuccessBase' - type: object required: - apiKeys - catalog properties: apiKeys: type: array items: $ref: '#/components/schemas/ApiKey' catalog: $ref: '#/components/schemas/ApiKeyCatalog' SuccessBase: type: object required: - ok - type properties: ok: type: boolean examples: - true type: type: string description: Stable success envelope discriminator added by v1. ApiKey: type: object required: - id - name - credentialLane - keyPrefix - keyLastFour - sandboxId - createdAt - lastUsedAt - usage - resources properties: id: type: string examples: - sak_123 name: type: string examples: - Production worker credentialLane: type: string enum: - legacy - scoped-v1 description: >- Credential storage lane. Scoped secrets are never stored in the legacy hash column. keyPrefix: type: string examples: - box_live keyLastFour: type: string examples: - 9abc sandboxId: type: - string - 'null' description: >- Box ID for a platform-managed machine key, or null for a user-created key. createdAt: type: string format: date-time lastUsedAt: type: - string - 'null' format: date-time usage: $ref: '#/components/schemas/ApiKeyRequestUsage' resources: $ref: '#/components/schemas/ApiKeyResourceTotals' expiresAt: type: - string - 'null' format: date-time expired: type: boolean expiringSoon: type: boolean scope: type: object properties: expiresAt: type: - string - 'null' format: date-time actions: type: array items: type: string boxes: oneOf: - type: string enum: - '*' - type: array items: type: string environments: oneOf: - type: string enum: - '*' - type: array items: type: string grandfathered: type: boolean ApiKeyCatalog: type: object required: - actions - presets - defaultTtl - maxTtl - scopedCreationEnabled properties: actions: type: array items: type: string presets: type: object additionalProperties: type: array items: type: string defaultTtl: type: string examples: - 90d maxTtl: type: string examples: - 365d scopedCreationEnabled: type: boolean description: Whether POST /api-keys/scoped currently accepts creation requests. scopeResources: type: object description: >- Session-only selector resources. Omitted when the caller authenticates with an API key. required: - boxes - environments properties: boxes: type: array items: $ref: '#/components/schemas/ApiKeyScopeResource' environments: type: array items: $ref: '#/components/schemas/ApiKeyScopeResource' ErrorEnvelope: type: object required: - ok - type - status - code - message - error - requestId properties: ok: type: boolean examples: - false type: type: string examples: - box.error status: type: integer examples: - 409 code: type: string examples: - provider_not_configured message: type: string examples: - Prompting is locked until Codex is configured on the Agents page. requestId: type: string examples: - req_01HX... error: type: object required: - code - message - status properties: code: type: string message: type: string status: type: integer details: type: object additionalProperties: true ApiKeyRequestUsage: type: object required: - requests - windowDays properties: requests: type: integer minimum: 0 description: >- Requests authenticated with this key during the current UTC day and the previous 29 UTC days. examples: - 1842 windowDays: type: integer const: 30 ApiKeyResourceTotals: type: object required: - total - boxes - agents properties: total: type: integer minimum: 0 boxes: type: integer minimum: 0 agents: type: integer minimum: 0 ApiKeyScopeResource: type: object required: - id - name - organizationId - organizationName properties: id: type: string name: type: string organizationId: type: string organizationName: type: string responses: Unauthorized: description: Missing or invalid bearer token. content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' examples: unauthorized: value: ok: false type: box.error status: 401 code: unauthorized message: Unauthorized error: code: unauthorized message: Unauthorized status: 401 requestId: req_01HX... Forbidden: description: Authenticated token is not allowed to perform this action. content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' examples: forbidden: value: ok: false type: box.error status: 403 code: forbidden message: Forbidden error: code: forbidden message: Forbidden status: 403 requestId: req_01HX... securitySchemes: BoxBearerAuth: type: http scheme: bearer bearerFormat: box_api_key description: >- Boat bearer token in the form `box_...`. Service API keys authenticate Boat operations. ````