List Organization API Keys

GET /organization-pats

List Pats

cURL

curl --request GET \
  --url https://api.example.com/organization-pats \
  --header 'Authorization: Bearer <token>'

200

[
  {
    "id": "<string>",
    "name": "<string>",
    "key_id": "<string>",
    "pat_key": "<string>",
    "expires_at": "<string>",
    "created_at": "<string>",
    "owner_user_id": "<string>",
    "owner_name": "<string>"
  }
]

Organization API keys (ak_…) are AnyCRM’s own credential type — see Authentication for how they differ from user personal access tokens. All eight PAT/key management endpoints are gated on the token-management scopes (pats:read, pats:create, pats:delete), which every default role carries.

Auth

Requires pats:read and an active organization. Results are filtered to the caller’s own user_id and, through row-level security, the token’s active organization.

A caller holding organizations:manage (the admin role) instead gets every key in the organization, so an admin can revoke a departed member’s key — see Delete an Organization API Key. Keys owned by another member carry owner_user_id and owner_name; the admin’s own keys leave both null, so the two are always distinguishable.

Response

200 OK — a bare JSON array (no envelope), ordered newest-first.

Field	Type	Description
id	string (uuid)	The key’s row id in the pats table — use this for Delete an Organization API Key.
name	string	Label given at creation.
pat_key	null	Always null on list — the plaintext secret is only ever returned once, on create.
key_id	string	First 15 characters of the internal ak_<hex> key id — a display-only partial identifier, not the full id and not enough to reconstruct the secret.
expires_at	string | null	ISO 8601 timestamp, or null if the key never expires.
created_at	string | null	ISO 8601 timestamp.
owner_user_id	string | null	The Logto user id of the member who owns the key — set only when that isn’t you, so it is always null outside the admin view.
owner_name	string | null	Display name (or email) for owner_user_id. null when the key is yours, or when the name couldn’t be resolved — the listing still succeeds, just unlabelled.

Authorizations

Authorization · string · header · required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Response

200 - application/json

Successful Response

id · string · required

name · string · required

key_id · string · required

pat_key · string | null

expires_at · string | null

created_at · string | null

owner_user_id · string | null

owner_name · string | null