List API Keys (Admin)

List API keys across all users in the org with owner email, scope, last-used timestamp, and 12-character key prefix. The raw key is NEVER returned. Requires an admin-scoped API key.

Parameters

Name	Type	Default	Description
user_id	string	-	Filter by owning user ID.
scope	string	-	Filter by scope. Pre-#1150 keys with NULL scope are returned under user.
include_system_managed	boolean	-	Include OAuth/onboarding-managed keys (default false).
limit	integer	-	Page size (1-500, default 100).
cursor	string	-	Opaque pagination cursor.

Use Cases

• Inventory every API key in the org with its owner email, scope, and last-used time
• Find all admin-scoped keys — filter by scope to audit privileged access
• List a single user's API keys before offboarding them

Example Usage

First page of all keys

{
  "tool": "admin_list_api_keys",
  "arguments": {}
}

Only admin-scoped keys

{
  "tool": "admin_list_api_keys",
  "arguments": {
    "scope": "admin"
  }
}

Keys for one user, including system-managed

{
  "tool": "admin_list_api_keys",
  "arguments": {
    "user_id": "3f7c2b1a-9d4e-4c2a-8b1f-0a1b2c3d4e5f",
    "include_system_managed": true
  }
}

Response Format

Field	Type	Description
apiKeys	array	API keys page (up to limit items). Use nextCursor to fetch the next page.
apiKeys[].id	string
apiKeys[].name	string
apiKeys[].keyPrefix	string	First 12 characters of the raw key for identification — never the full raw key.
apiKeys[].scope	string	Coerced from null → 'user' for pre-#1150 rows.
apiKeys[].userId	string
apiKeys[].userEmail	string | null
apiKeys[].userName	string | null
apiKeys[].isSystemManaged	boolean
apiKeys[].createdAt	string
apiKeys[].lastUsedAt	string | null
nextCursor	string | null	Opaque cursor for the next page; null when no more results.