> ## Documentation Index
> Fetch the complete documentation index at: https://docs.stabyl.com/llms.txt
> Use this file to discover all available pages before exploring further.

# List API keys

> Lists active API keys owned by the authenticated API key's account, including keys created through a browser session. Returns the same metadata as GET /developer/api/keys. Requires explicit api-keys:view scope. Only the last four characters are returned; full credentials and secrets are never returned. This is account-scoped, not an organization-wide listing.

Select `api-keys:view` explicitly when creating your inventory credential; it is excluded from default scopes. See [List your API keys](https://docs.stabyl.com/docs/authentication.md#list-your-api-keys). This read-only endpoint lists active keys for the authenticated account and never reveals full credentials or secrets.


## OpenAPI

````yaml /openapi/openapi.json get /partner/api/keys
openapi: 3.1.0
info:
  contact:
    email: support@stabyl.com
    name: Stabyl Support
  description: >-
    REST API for approved Stabyl accounts to automate exchange, wallet, and
    non-production simulation workflows.
  license:
    name: Proprietary
  title: Stabyl API
  version: 1.0.0
servers:
  - description: Production
    url: https://api.stabyl.com/v1
  - description: Staging
    url: https://api-staging.stabyl.com/v1
security: []
tags:
  - description: >-
      Read the authenticated account’s API key inventory without revealing
      credentials.
    name: API Keys
  - description: Trading market data and order management for account automation.
    name: Exchange
  - description: >-
      Supported routes, deposit destinations, balances, transactions, and saved
      recipients.
    name: Wallets
  - description: >-
      Outbound event delivery configuration and eventually consistent delivery
      history. Verify Standard Webhooks webhook-id, webhook-timestamp, and
      webhook-signature headers against the unchanged raw request body before
      parsing JSON.
    name: Webhooks
  - description: >-
      Non-production endpoints for testing integration behavior. API-key or
      session authentication allows user_id to be omitted; unauthenticated
      user-targeted requests require user_id. All users are automatically
      KYB-approved in development and staging.
    name: Simulation
paths:
  /partner/api/keys:
    get:
      tags:
        - API Keys
      summary: List API keys
      description: >-
        Lists active API keys owned by the authenticated API key's account,
        including keys created through a browser session. Returns the same
        metadata as GET /developer/api/keys. Requires explicit api-keys:view
        scope. Only the last four characters are returned; full credentials and
        secrets are never returned. This is account-scoped, not an
        organization-wide listing.
      operationId: get_partner_api_keys
      responses:
        '200':
          content:
            application/json:
              example:
                data:
                  keys:
                    - audience: external_partner
                      auth_scheme: ed25519_v1
                      created_at: '2026-10-26T10:00:00Z'
                      id: 01980d95-5537-76aa-88a8-ad59117632ef
                      ip_allowlist: []
                      key_last4: t5QZ
                      last_used_at: null
                      name: Integration
                      scopes:
                        - api-keys:view
                        - webhooks:view
                      withdrawal_scope_granted_at: null
                status: success
              schema:
                properties:
                  data:
                    $ref: '#/components/schemas/ApiKeyListResponse'
                  status:
                    enum:
                      - success
                    type: string
                required:
                  - status
                  - data
                type: object
          description: Owned API keys
        '401':
          content:
            application/json:
              example:
                error:
                  code: UNAUTHORIZED
                  message: missing X-Api-Key header
                status: error
              schema:
                properties:
                  error:
                    properties:
                      code:
                        example: UNAUTHORIZED
                        type: string
                      message:
                        example: missing X-Api-Key header
                        type: string
                    required:
                      - code
                      - message
                    type: object
                  status:
                    enum:
                      - error
                    type: string
                required:
                  - status
                  - error
                type: object
          description: Unauthorized
        '403':
          content:
            application/json:
              example:
                error:
                  code: FORBIDDEN
                  message: request is not allowed
                status: error
              schema:
                properties:
                  error:
                    properties:
                      code:
                        example: FORBIDDEN
                        type: string
                      message:
                        example: request is not allowed
                        type: string
                    required:
                      - code
                      - message
                    type: object
                  status:
                    enum:
                      - error
                    type: string
                required:
                  - status
                  - error
                type: object
          description: Missing api-keys:view scope
      security:
        - api_key: []
components:
  schemas:
    ApiKeyListResponse:
      properties:
        keys:
          items:
            $ref: '#/components/schemas/ApiKeySummary'
          type: array
      required:
        - keys
      type: object
    ApiKeySummary:
      properties:
        audience:
          type: string
        auth_scheme:
          type: string
        created_at:
          format: date-time
          type: string
        id:
          format: uuid
          type: string
        ip_allowlist:
          items:
            type: string
          type: array
        key_last4:
          type: string
        last_used_at:
          format: date-time
          type:
            - string
            - 'null'
        name:
          type: string
        scopes:
          items:
            type: string
          type: array
        withdrawal_scope_granted_at:
          format: date-time
          type:
            - string
            - 'null'
      required:
        - id
        - name
        - key_last4
        - scopes
        - audience
        - auth_scheme
        - ip_allowlist
        - created_at
      type: object
  securitySchemes:
    api_key:
      description: >-
        API credential. Withdrawal quote and submit operations additionally
        require the documented Ed25519 timestamp, nonce, and signature headers.
      in: header
      name: X-Api-Key
      type: apiKey
      x-default: sb_test_your_key

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.