List API keys
Cursor-paginated list of the organization's API keys (both generations), metadata only — never hashes or plaintext secrets.
Cursor-paginated list of the organization's API keys (both generations), metadata only — never hashes or plaintext secrets.
Authorization
bearerAuth A gid_ API key (Settings → API keys) or an OAuth 2.1 access token.
In: header
Query Parameters
Maximum number of items to return (1-100).
1 <= value <= 10025Opaque cursor from a previous page's next_cursor — omit for the first page. Reusing a cursor with DIFFERENT query parameters (e.g. a different limit) answers 400 validation_failed.
Response Body
application/json
application/problem+json
application/problem+json
application/problem+json
application/problem+json
application/problem+json
curl -X GET "https://example.com/v1/api-keys"{ "data": [ { "id": "string", "name": "string", "key_prefix": "string", "scopes": [ "workspaces:read" ], "last_used_at": "2019-08-24T14:15:22Z", "expires_at": "2019-08-24T14:15:22Z", "created_at": "2019-08-24T14:15:22Z", "legacy": true } ], "has_more": true, "next_cursor": "string"}API reference
Every operation in the GetItDone public REST API, grouped by resource — organizations, tasks, projects, the daily plan, attachments, members, usage, API keys, and webhooks.
Create an API key POST
Mints a new org-owned API key. Beyond the `api-keys:manage` scope check, the CALLING credential's creator must currently hold an owner/admin membership in the organization — a key minted while its creator was an admin stops being able to mint further keys the moment that user is demoted (403 `insufficient_scope`). Supports the optional `Idempotency-Key` header; note the replay caution: a replayed response includes the ORIGINAL plaintext `key` again within the 24h replay window (the same tradeoff Stripe makes for idempotent secret-bearing responses) — treat a stored Idempotency-Key as equally sensitive to the secret itself.