> ## Documentation Index
> Fetch the complete documentation index at: https://dev.haico.gr/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# List Keys

> List the caller's personal access tokens, newest first.

Revoked and expired keys are included so the user can confirm a revocation
took effect and can tell an expired key apart from one that was deleted.
Secrets are never returned; only the prefix and last four characters are,
which are enough to identify a key without disclosing it.



## OpenAPI

````yaml /openapi.json get /api/keys
openapi: 3.1.0
info:
  title: HAI-Co² API
  description: Human-AI Co-Construction reference implementation.
  version: 0.1.0
servers:
  - url: https://haico.gr
    description: Production
  - url: https://dev.haico.gr
    description: Development
  - url: http://localhost:8000
    description: Local development
security: []
paths:
  /api/keys:
    get:
      tags:
        - API Keys
      summary: List Keys
      description: >-
        List the caller's personal access tokens, newest first.


        Revoked and expired keys are included so the user can confirm a
        revocation

        took effect and can tell an expired key apart from one that was deleted.

        Secrets are never returned; only the prefix and last four characters
        are,

        which are enough to identify a key without disclosing it.
      operationId: list_keys_api_keys_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiKeyListResponse'
      security:
        - HTTPBearer: []
components:
  schemas:
    ApiKeyListResponse:
      properties:
        keys:
          items:
            $ref: '#/components/schemas/ApiKeySchema'
          type: array
          title: Keys
      type: object
      required:
        - keys
      title: ApiKeyListResponse
      description: All of the caller's keys, newest first.
    ApiKeySchema:
      properties:
        id:
          type: integer
          title: Id
        name:
          type: string
          title: Name
        key_prefix:
          type: string
          title: Key Prefix
        last_four:
          type: string
          title: Last Four
        scopes:
          type: string
          title: Scopes
        created_at:
          type: string
          format: date-time
          title: Created At
        last_used_at:
          anyOf:
            - type: string
              format: date-time
            - type: 'null'
          title: Last Used At
        expires_at:
          anyOf:
            - type: string
              format: date-time
            - type: 'null'
          title: Expires At
        revoked_at:
          anyOf:
            - type: string
              format: date-time
            - type: 'null'
          title: Revoked At
        active:
          type: boolean
          title: Active
      type: object
      required:
        - id
        - name
        - key_prefix
        - last_four
        - scopes
        - created_at
        - active
      title: ApiKeySchema
      description: A key's non-secret metadata. The plaintext is never included here.
  securitySchemes:
    HTTPBearer:
      type: http
      description: >-
        A personal access token (`haico_pat_...`), created under Profile → API
        keys. Send it as `Authorization: Bearer <key>`. The browser session JWT
        is also accepted but is an internal mechanism and is not part of the
        public contract.
      scheme: bearer

````