> ## Documentation Index > Fetch the complete documentation index at: https://developers.factify.com/llms.txt > Use this file to discover all available pages before exploring further. # List API keys > Lists API keys for the caller's organization. Secrets are never returned — use the `prefix` field to identify a key in the UI. Authorization: requires organization admin role. ## OpenAPI ````yaml /openapi.json get /v1/api-keys openapi: 3.1.0 info: title: Factify API version: 1.1.1 description: >- Factify API enables organizations to ingest records, manage workflows, and extract auditable facts. ## Authentication Bearer authentication header of the form `Bearer `, where `` is your auth token. ``` Authorization: Bearer ffy_prod_ ``` ## Rate Limiting Per-API-key rate limits apply. Concrete thresholds are configured per deployment and surface via standard `Retry-After` and `RateLimit-*` response headers when a request is throttled. ## Errors Factify uses conventional HTTP status codes and returns structured error responses following [RFC 9457](https://www.rfc-editor.org/rfc/rfc9457) (Problem Details for HTTP APIs). contact: name: Factify API Support email: api@factify.com url: https://factify.com/support license: name: Proprietary url: https://factify.com/terms servers: - url: https://api.factify.com description: Production security: - bearerAuth: [] tags: - name: Organizations description: Organizations and their settings. - name: Members description: Membership roster and roles within an organization. - name: Invitations description: Pending invitations to join an organization. - name: Users description: The authenticated user's profile. - name: ApiKeys description: API keys used to authenticate SDK and integration callers. - name: Usage description: | Per-organization usage and quota limits. Future operations covering API-key-level quotas and usage history land here too. - name: Connections description: Inbound integration connections that records are ingested from. - name: Workflows description: Workflow templates that define the rubric set for fact extraction. - name: Plans description: Workflow instances — bind claims and lock to produce an extraction spec. - name: Records description: Generic JSON records ingested for claim extraction. - name: Audit description: Unified audit and provenance events. - name: Notifications description: In-app notification feed backed by audit events and per-user read state. - name: Internal description: Internal callbacks not intended for public SDK consumers. - name: RubricContentions description: >- Rubric contention detection and resolution — surface and resolve competing claim bindings. - name: IdentityProviders description: Per-organization SAML identity providers for SSO. - name: Analytics description: >- Org-scoped execution analytics — volume, decision breakdown, and latency over plan executions. - name: Auth description: | Browser-facing authentication surface — CSRF, session, OAuth callback, OTP, passkey, and refresh-token endpoints. These predate factapi's versioned `/v1/*` SDK surface and use the BetterAuth wire format the workspace SPA already speaks; SDK generators skip them via `x-speakeasy-ignore`. paths: /v1/api-keys: get: tags: - ApiKeys summary: List API keys description: | Lists API keys for the caller's organization. Secrets are never returned — use the `prefix` field to identify a key in the UI. Authorization: requires organization admin role. operationId: listApiKeys parameters: - $ref: '#/components/parameters/OrgScopeHeader' - name: include_revoked in: query description: | Whether to include revoked keys. Defaults to `false`. Expired-but-not-revoked keys are always returned; use the `is_active` field to filter currently usable keys. required: false schema: type: boolean example: false responses: '200': description: A list of API keys for the organization. content: application/json: schema: $ref: '#/components/schemas/ListAPIKeysOutputBody' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '429': $ref: '#/components/responses/TooManyRequests' '500': $ref: '#/components/responses/InternalServerError' components: parameters: OrgScopeHeader: name: X-Factify-Organization-Id in: header required: false description: | Optional. Factify-staff acting-as override: when set, factapi resolves the request against this organization instead of the session-bound one. Honored only for callers with `@factify.com` emails; non-staff requests carrying this header are rejected with 403. The value is a typed org id (e.g. `org_01h2xcejqtf2nbrexx3vqjhp41`). schema: type: string pattern: ^org_[0-9a-hjkmnp-tv-z]{26}$ example: org_01h2xcejqtf2nbrexx3vqjhp41 schemas: ListAPIKeysOutputBody: additionalProperties: false type: object description: >- A page of API keys for the caller's organization. Secrets are never included. properties: api_keys: type: array description: API keys for the organization. items: $ref: '#/components/schemas/APIKey' required: - api_keys APIKey: additionalProperties: false type: object description: | An authentication credential for programmatic API access, scoped to a single organization. Keys cannot be updated; rotate by creating a new key and revoking the old one. properties: id: type: string description: | Unique TypedID for the API key. Pattern: `key_[0-9a-hjkmnp-tv-z]{26}` example: key_01h2xcejqtf2nbrexx3vqjhp41 org_id: type: string description: | TypedID of the organization this key belongs to. Pattern: `org_[0-9a-hjkmnp-tv-z]{26}` example: org_01h2xcejqtf2nbrexx3vqjhp41 name: type: string description: Human-readable name for the key (e.g., "Production", "Staging"). example: Production Key prefix: type: string description: > Truncated key prefix for identification in UI (e.g., "ffy_prod_01kdx2z2..."). Safe to log; the full secret is only returned once at creation time. example: ffy_prod_01kdx2z2... created_at: type: string format: date-time description: Timestamp when the key was created. example: '2025-01-15T10:30:00Z' updated_at: type: string format: date-time description: Timestamp of the last metadata update (rename, revocation, etc.). example: '2025-01-15T10:35:00Z' is_active: type: boolean description: > Whether the key is currently usable for authentication. Computed: `is_active = (revoked_at == null) && (expires_at == null || expires_at > now())`. example: true expires_at: type: string format: date-time description: >- Expiration timestamp. If set, the key becomes invalid after this time. example: '2026-01-15T10:30:00Z' revoked_at: type: string format: date-time description: >- Timestamp when the key was revoked. Absent if the key has not been revoked. revoked_by: type: string description: | TypedID of the user who revoked the key. Absent if the key has not been revoked. Pattern: `usr_[0-9a-hjkmnp-tv-z]{26}` example: usr_01h2xcejqtf2nbrexx3vqjhp41 revoked_comment: type: string description: >- Optional human-readable reason recorded at revocation time (audit only). example: rotated required: - id - org_id - name - prefix - created_at - updated_at - is_active ErrorModel: additionalProperties: false type: object properties: detail: type: string description: >- A human-readable explanation specific to this occurrence of the problem. example: Property foo is required but is missing. errors: description: Optional list of individual error details type: array items: $ref: '#/components/schemas/ErrorDetail' instance: type: string format: uri description: >- A URI reference that identifies the specific occurrence of the problem. example: https://example.com/error-log/abc123 status: type: integer format: int64 description: HTTP status code example: 400 title: type: string description: >- A short, human-readable summary of the problem type. This value should not change between occurrences of the error. example: Bad Request type: type: string format: uri default: about:blank description: A URI reference to human-readable documentation for the error. example: https://example.com/errors/example ErrorDetail: additionalProperties: false type: object properties: location: type: string description: >- Where the error occurred, e.g. 'body.items[3].tags' or 'path.thing-id' message: type: string description: Error message text value: description: The value at the given location responses: Unauthorized: description: Unauthorized content: application/problem+json: schema: $ref: '#/components/schemas/ErrorModel' example: type: about:blank title: Unauthorized status: 401 detail: Missing or invalid authentication credentials. Forbidden: description: Forbidden content: application/problem+json: schema: $ref: '#/components/schemas/ErrorModel' example: type: about:blank title: Forbidden status: 403 detail: >- You do not have permission to perform this action on this resource. TooManyRequests: description: Too Many Requests content: application/problem+json: schema: $ref: '#/components/schemas/ErrorModel' example: type: about:blank title: Too Many Requests status: 429 detail: >- Rate limit exceeded. Retry after the period indicated by the Retry-After header. InternalServerError: description: Internal Server Error content: application/problem+json: schema: $ref: '#/components/schemas/ErrorModel' example: type: about:blank title: Internal Server Error status: 500 detail: >- An unexpected error occurred. Retry, and contact support if the issue persists. securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: API Key description: | Bearer authentication using a factapi-issued API key (`ffy__`). Cookie-based sessions are accepted automatically by user-facing endpoints but are not surfaced as an OpenAPI auth scheme. ````