# Get an API key

> The api_keys.get operation: GET /api/v1/api_keys/{id} in the REST API and the api_keys_get tool in the MCP server.

Returns one API key by its ID (`key_…`): name, kind, binding, scopes, status, and when it was last used.
Never returns the secret or its hash. Keys of another mode, or outside the brand or entity of the request,
are `resource_not_found`.

## At a glance

- **REST:** `GET /api/v1/api_keys/{id}`
- **MCP tool:** `api_keys_get`
- **Operation ID:** `api_keys.get`
- **Scope:** Organization, or one of its legal entities or brands
- **Permission:** `keys:read`
- **Risk tier:** `read`
- **Dry run:** Not supported
- **Idempotency:** Not needed (read only)
- **Modes:** Test and live
- **Authentication:** API key with the `keys:read` scope
- **Since:** M1

## Request

### Path parameters

| Field | Type       | Description |
| ----- | ---------- | ----------- |
| `id`  | `key_…` ID |             |

### Query parameters

This operation takes no query parameters.

## Response

`200 OK` with a JSON object:

| Field        | Type                                                                                               | Description |
| ------------ | -------------------------------------------------------------------------------------------------- | ----------- |
| `id`         | `key_…` ID                                                                                         |             |
| `object`     | `"api_key"`                                                                                        |             |
| `kind`       | one of `org`, `entity`, `brand`                                                                    |             |
| `livemode`   | boolean                                                                                            |             |
| `name`       | string                                                                                             |             |
| `prefix`     | string                                                                                             |             |
| `scopes`     | array of one of 98 values, e.g. `org:read`, `org:write`, `org:admin` (all in the OpenAPI document) |             |
| `status`     | one of `active`, `expired`, `revoked`                                                              |             |
| `orgId`      | `org_…` ID                                                                                         |             |
| `entityId`   | `ent_…` ID or null                                                                                 |             |
| `brandId`    | `brd_…` ID or null                                                                                 |             |
| `createdBy`  | string                                                                                             |             |
| `createdAt`  | date-time                                                                                          |             |
| `updatedAt`  | date-time                                                                                          |             |
| `expiresAt`  | date-time or null                                                                                  |             |
| `lastUsedAt` | date-time or null                                                                                  |             |
| `revokedAt`  | date-time or null                                                                                  |             |

## Examples

### A brand key that was used recently

```http
GET /api/v1/api_keys/key_01m4ttwd3tesktp0hc6bpxwkpd
Authorization: Bearer or_test_…
```

Response (`200`):

```json
{
  "id": "key_01m4ttwd3tesktp0hc6bpxwkpd",
  "object": "api_key",
  "kind": "brand",
  "livemode": false,
  "name": "Billing backend",
  "prefix": "or_test_acme",
  "scopes": ["customers:write", "subscriptions:write", "usage:write"],
  "status": "active",
  "orgId": "org_01m4ttwd3veh9apbewxheq5xh3",
  "entityId": "ent_01m4ttwd3veh9apbewxheq5xh4",
  "brandId": "brd_01m4ttwd3veh9apbewxheq5xh5",
  "createdBy": "usr_01m4ttwd3veh9apbewxheq5xh6",
  "createdAt": "2026-10-13T12:00:00.000Z",
  "updatedAt": "2026-10-13T12:00:00.000Z",
  "expiresAt": null,
  "lastUsedAt": "2026-10-20T09:30:00.000Z",
  "revokedAt": null
}
```

## Errors

| Code                                                                                     | HTTP status | When                                                                 | What to do                                                                                           |
| ---------------------------------------------------------------------------------------- | ----------- | -------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- |
| [`resource_not_found`](https://ownrecord.io/docs/reference/errors.md#resource_not_found) | 404         | No key with this ID is visible in the scope and mode of the request. | Check the ID and that your credentials are scoped to the right organization, entity, brand and mode. |
| [`permission_denied`](https://ownrecord.io/docs/reference/errors.md#permission_denied)   | 403         | You can't see API keys here.                                         | Ask an organization owner or admin for a role or scope that allows this action.                      |

It can also return these [common errors](https://ownrecord.io/docs/reference.md#common-errors): [`validation_failed`](https://ownrecord.io/docs/reference/errors.md#validation_failed), [`api_version_unsupported`](https://ownrecord.io/docs/reference/errors.md#api_version_unsupported), [`authentication_required`](https://ownrecord.io/docs/reference/errors.md#authentication_required), [`api_key_invalid`](https://ownrecord.io/docs/reference/errors.md#api_key_invalid), [`dry_run_not_supported`](https://ownrecord.io/docs/reference/errors.md#dry_run_not_supported), [`rate_limited`](https://ownrecord.io/docs/reference/errors.md#rate_limited), [`internal_error`](https://ownrecord.io/docs/reference/errors.md#internal_error).