# Get an API key

Source: https://api-docs.magicdoor.com/api-reference/api-keys/get-api-key

Fetches one API key by id, including when it was last used and whether it has been revoked. The secret half of the key is not returned here and cannot be recovered. Requires the `api_keys:read` permission.

`GET https://auth.magicdoor.com/company-portal/api-keys/{apiKeyId}`

**Authentication:** bearer token in the `Authorization` header, as `Bearer <token>`.

## Path parameters

- `apiKeyId` (string, required) — The key to fetch, as a Snowflake id in decimal-string form. Must be a positive whole number. Example: `1830472847398404096`.

## Example request

```bash
curl --request GET \
  --url 'https://auth.magicdoor.com/company-portal/api-keys/1830472847398404096' \
  --header 'Authorization: Bearer <token>'
```

## Responses

### 200 — The key

- `id` (string) — This key's id, a Snowflake sent as a decimal string. It is also the middle segment of the key string the integration holds.
- `name` (string) — The label the issuer gave the key, so keys can be told apart.
- `userId` (string) — The user the key acts as. The key can never do more than this user can.
- `permissions` (string[]) — What the key may do, as `resource:action` strings. This is the ceiling rather than a guarantee: the set is narrowed to the user's current permissions every time the key is exchanged. Absent when the key is unscoped, which means it carries whatever its user can do.
- `created` (string, date-time) — When the key was issued, in the company's timezone and with no offset.
- `expires` (string, date-time) — When the key stops working, in the company's timezone. Absent for a key that does not expire on its own.
- `lastUsed` (string, date-time) — When the key was last exchanged for an access token, in the company's timezone. Absent while the key has never been used.
- `revoked` (string, date-time) — When the key was revoked, in the company's timezone. Absent while the key is still live.

```json
{
  "id": "1830472847398404096",
  "name": "Nightly rent-roll sync",
  "userId": "1824903117441335296",
  "permissions": [
    "properties:read",
    "units:read",
    "leases:read"
  ],
  "created": "2026-08-17T21:04:11",
  "expires": "2027-01-01T00:00:00",
  "lastUsed": "2026-08-17T23:15:02"
}
```

### 401 — The access token is missing, expired, or invalid

### 403 — The caller does not hold the `api_keys:read` permission

### 404 — No such key, or the key belongs to another company

```json
{
  "type": "https://httpstatuses.com/404",
  "title": "Not Found",
  "status": 404,
  "detail": "ApiKey not found.",
  "instance": "/company-portal/api-keys/1830472847398404096",
  "traceId": "0HN7GK9C2M4PQ",
  "entityType": "ApiKey",
  "entityId": "1830472847398404096"
}
```

A revoked key is still returned here — revoking keeps the row so a UI can show when the key stopped working. Look at `revoked` rather than assuming the key is live.