Get an API key

Fetches one API key by id, including when it was last used and whether it has been revoked. The secret half of the key is not returned here and cannot be recovered. Requires the api_keys:read permission.

Authorization

Authorizationstringrequired

Bearer token — Send your API token in the Authorization header as Bearer <token>. Requests without a valid token are rejected with 401 Unauthorized.

Path parameters

apiKeyIdstringrequired

The key to fetch, as a Snowflake id in decimal-string form. Must be a positive whole number.

example: 1830472847398404096

Response

200 · The key

idstring

This key's id, a Snowflake sent as a decimal string. It is also the middle segment of the key string the integration holds.

namestring

The label the issuer gave the key, so keys can be told apart.

userIdstring

The user the key acts as. The key can never do more than this user can.

permissionsstring[]

What the key may do, as resource:action strings. This is the ceiling rather than a guarantee: the set is narrowed to the user's current permissions every time the key is exchanged. Absent when the key is unscoped, which means it carries whatever its user can do.

createdstring · date-time

When the key was issued, in the company's timezone and with no offset.

expiresstring · date-time

When the key stops working, in the company's timezone. Absent for a key that does not expire on its own.

lastUsedstring · date-time

When the key was last exchanged for an access token, in the company's timezone. Absent while the key has never been used.

revokedstring · date-time

When the key was revoked, in the company's timezone. Absent while the key is still live.

401 · The access token is missing, expired, or invalid

403 · The caller does not hold the `api_keys:read` permission

404 · No such key, or the key belongs to another company

A revoked key is still returned here — revoking keeps the row so a UI can show when the key stopped working. Look at revoked rather than assuming the key is live.