List API keys

GET

/v1/keys

const url = 'https://api.overwatch.weareheavy.dev/v1/keys';
const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url https://api.overwatch.weareheavy.dev/v1/keys \
  --header 'Authorization: Bearer <token>'

The organization’s keys, masked — only the display prefix (start) is returned; the plaintext exists only at creation. Session-only, owner/admin.

Authorizations

BearerAuth

Responses

200

The organization’s keys.

application/json

object

keys

required

Array<object>

A stored API key, masked — the plaintext is only returned at creation.

object

required

string

name

required

string | null

start

required

The visible key prefix for display (e.g. wah_CL).

string | null

enabled

required

integer

Allowed values: 0 1

created_at

required

ISO 8601 (key records come from the auth layer).

string format: date-time

expires_at

required

ISO 8601 expiry, or null for a non-expiring key.

string | null format: date-time

site_ids

required

The key’s site scope, or null for full organization access.

Array<string> | null

Example

{
  "keys": [
    {
      "enabled": 0
    }
  ]
}

401

Missing or invalid credentials.

application/json

object

error

required

A human-readable error message.

string

Example

{
  "error": "invalid api key"
}

403

A dashboard session is required (API-key callers are rejected), or the session’s role does not allow this action.

application/json

object

error

required

A human-readable error message.

string

Example

{
  "error": "a dashboard session is required"
}