> ## Documentation Index > Fetch the complete documentation index at: https://widgetic.com/llms.txt > Use this file to discover all available pages before exploring further. # List the API keys of an account > Lists the API keys of an account, in the order they were made: name, the first characters of the key, when it was made, when it expires, when it was last used, whether it is switched on and what it is limited to (`scopes` and `preset`). The secret of a key is never part of the list. A caller can list its own account's keys; Widgetic staff can list any account's. ## OpenAPI ````yaml /openapi/widgetic-api-public.json get /users/{id}/keys openapi: 3.0.0 info: title: Widgetic API Gateway version: 1.0.0 description: API documentation for the Widgetic API Gateway license: name: Widgetic Integration License url: https://docs.widgetic.com/resources/license servers: - url: https://api.widgetic.com/v1 description: Production server variables: env: default: production description: Environment apiUrl: default: https://api.widgetic.com description: API URL apiVersion: default: /v1 description: API Version path prefix security: [] tags: [] paths: /users/{id}/keys: get: tags: - Users summary: List the API keys of an account description: >- Lists the API keys of an account, in the order they were made: name, the first characters of the key, when it was made, when it expires, when it was last used, whether it is switched on and what it is limited to (`scopes` and `preset`). The secret of a key is never part of the list. A caller can list its own account's keys; Widgetic staff can list any account's. operationId: getUserApiKeys parameters: - name: id in: path required: true description: The account the keys belong to. For your own keys, your own user id schema: type: string format: uuid responses: '200': description: The keys of the account (an empty list for an account with none) content: application/json: schema: type: object properties: success: type: boolean data: type: array items: $ref: '#/components/schemas/UserApiKey' meta: $ref: '#/components/schemas/ResponseMeta' required: - success - data '400': description: The account id is not a valid id content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '401': description: Not authenticated content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '403': description: The keys belong to another account content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' security: - apiKeyAuth: [] components: schemas: UserApiKey: type: object description: >- An API key of an account, as it is listed. It never carries the secret: that is shown once, in the answer to the request that made the key, and cannot be read again. properties: keyId: type: string description: >- The id of the key. Use it to rename, switch off, delete or read the usage of the key example: 5f0c1e2a-7a41-4c5e-9f3b-0c2a8b1d6e44 keyPreview: type: string description: >- The first characters of the key, to tell keys apart. Not enough to use it example: wgt_prt_ab12... name: type: string description: The name given to the key example: Production createdAt: type: string format: date-time expiresAt: type: string format: date-time nullable: true description: When the key stops working. Absent or null when it does not expire lastUsedAt: type: string format: date-time nullable: true description: When the key was last used. Absent or null when it never was isActive: type: boolean description: >- Whether the key works. A key that is switched off is refused until it is switched on again scopes: type: array items: $ref: '#/components/schemas/ApiKeyScope' description: >- What the key may do. A key with full access holds every scope. The scopes of a key are fixed when it is made preset: type: string enum: - read_only - content - full_access - custom description: >- The name the scopes amount to. `full_access` is a key that is not limited, `read_only` and `content` are the ready-made lists, and `custom` is any other list required: - keyId - keyPreview - name - createdAt - isActive - scopes - preset example: keyId: 5f0c1e2a-7a41-4c5e-9f3b-0c2a8b1d6e44 keyPreview: wgt_prt_ab12... name: Production createdAt: '2026-01-15T09:30:00.000Z' expiresAt: '2026-01-15T09:30:00.000Z' lastUsedAt: '2026-01-15T09:30:00.000Z' isActive: true scopes: - Example ApiKeyScope preset: Example preset ResponseMeta: type: object description: >- Extra information about the answer: where a page sits in a list, the cursor of the next page, or warnings about a call that succeeded with a caveat. additionalProperties: true properties: page: type: integer description: The page that was read, counting from 1. example: 1 size: type: integer description: How many items one page holds. example: 20 total: type: integer description: How many items the whole list has. example: 135 limit: type: integer description: The same as `size`. example: 20 offset: type: integer description: How many items come before this page. example: 0 hasNextPage: type: boolean example: true hasPreviousPage: type: boolean example: false nextCursor: type: string nullable: true description: >- Pass this as `cursor` to read the next page of a list that is read by cursor. `null` on the last page. warnings: type: array items: type: string description: >- Things the call did not do, though it succeeded (for example a table that could not be created just now). ErrorResponse: type: object required: - success - message - error additionalProperties: true properties: success: type: boolean description: Always `false` on a failure. example: false message: type: string description: The same text as `error.message`, for a caller that reads one line. error: $ref: '#/components/schemas/ErrorDetail' ApiKeyScope: type: string enum: - content:read - content:write - generate - partner:read - partner:write - billing:read - billing:write - account:read - account:write description: >- One thing an API key may be allowed to do. A key made with a list of scopes does only what the list names; a key made without one has full access, and does everything its owner can. - `content:read` reads widgets, compositions, canvases, projects, folders, uploads, translations and the analytics of your content. - `content:write` creates, changes, publishes and deletes the same. It includes `content:read`. - `generate` runs the AI that builds widgets and compositions, and follows or cancels what it is doing. This spends credits. - `partner:read` reads managed users, what they spent, presets, the contract and the storage destination. - `partner:write` creates, changes and deletes managed users and presets. It includes `partner:read`. - `billing:read` reads credits, usage, invoices, subscriptions and payment methods. - `billing:write` buys credits, pays invoices and changes a subscription or a payment method. It includes `billing:read`. - `account:read` reads the profile, organizations and members, allowed domains, notices and the names of API keys. - `account:write` changes the profile, organizations and members, allowed domains and integrations. It includes `account:read`. Starting an editor session for a managed user needs `partner:write`, `content:write` and `generate` together. Making, changing and deleting keys, exchanging tokens, signing in and the administration routes need full access: a limited key cannot make itself a bigger one. A request outside the scopes of the key is refused with 403 and the code `API_KEY_SCOPE_MISSING`. `error.details.missingScopes` names what a new key needs, and `error.details.fullAccessRequired` is true when no list of scopes would have been enough. The scopes of a key cannot be changed once it is made. ErrorDetail: type: object required: - code - message - timestamp properties: code: type: string description: Machine-readable error code. example: RESOURCE_NOT_FOUND message: type: string description: Human-readable explanation. example: Composition not found param: type: string description: The field that caused the error, when one did. example: name docUrl: type: string description: Where this error is explained. suggestedAction: type: string description: What to do about it. retryAfter: type: integer description: >- Seconds to wait before trying again (rate limits). The same number is in the `Retry-After` header. example: 60 details: type: object additionalProperties: true description: >- More about the error: the fields that failed, a limit that was reached. correlationId: type: string description: Quote this when you ask support about the call. example: req_123e4567-e89b-12d3-a456-426614174000 timestamp: type: string format: date-time example: '2026-10-15T10:00:00.000Z' securitySchemes: apiKeyAuth: type: http scheme: bearer bearerFormat: JWT ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.