---
type: api
title: Get all API keys
description: Retrieves the metadata for the API keys the caller is allowed to see.
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/cloud-enterprise/v4/operation/operation-get-api-keys
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/cloud-enterprise/v4/operation/operation-get-api-keys
products:
  - Elastic Cloud Enterprise
---

# Get all API keys

## Paths

- `GET` `/users/auth/keys`

- [Basic auth](/elastic/docs-builder/docs/4371/api/doc/cloud-enterprise/v4/authentication#basicauth)
- [Api key auth](/elastic/docs-builder/docs/4371/api/doc/cloud-enterprise/v4/authentication#apikey)

## Description

Retrieves the metadata for the API keys the caller is allowed to see.

## Query String Parameters

- `next_page` (string)
  Pagination cursor to get the next page of records

## Response

The metadata for the API keys is retrieved.

`application/json`

- `keys` ([] ApiKeyResponse)
  The list of API keys.
  - `id` (string)
    The API key ID.
  - `user_id` (string)
    The user ID.
  - `organization_id` (string)
    The organization ID linked to the API key
  - `description` (string)
    The API key description. TIP: Useful when you have multiple API keys.
  - `key` (string)
    The API key. TIP: Since the API key is returned only once, save it in a safe place.
  - `creation_date` (string)
    The date/time for when the API key is created.
  - `expiration_date` (string)
    The date/time when the API key expires.
  - `role_assignments` ({} RoleAssignments)
    Roles assigned to users, API keys or organization invitations. Currently unavailable in self-hosted ECE.
    - `platform` ([] PlatformRoleAssignment)
      Assignments for roles with platform scope.
      - `role_id` (string)
        The ID of the role that is assigned.
    - `organization` ([] OrganizationRoleAssignment)
      Assignments for roles with organization scope.
      - `role_id` (string)
        The ID of the role that is assigned.
      - `organization_id` (string)
        The ID of the organization the role is scoped to.
      - `application_roles` ([] string)
        If provided, the user assigned this role assignment will be granted this application role when signing in to a deployment or project
    - `deployment` ([] DeploymentRoleAssignment)
      Assignments for roles with deployment scope.
      - `role_id` (string)
        The ID of the role that is assigned.
      - `organization_id` (string)
        The ID of the organization the role is scoped to.
      - `all` (boolean)
        When true, the role applies to all deployments in the organization, otherwise the role is scoped to the deployments specified in `deployment_ids`.
      - `deployment_ids` ([] string)
        The IDs of the deployments the role is scoped to. Must be absent if `all` is true, and present if `all` is false.
      - `application_roles` ([] string)
        If provided, the user assigned this role assignment will be granted this application role when signing in to the deployment(s) specified in the role assignment.
    - `project` ({} ProjectRoleAssignments)
      Assignments for roles with project scope.
      - `elasticsearch` ([] ProjectRoleAssignment)
        The Elasticsearch project-scoped role assignments to set
        - `role_id` (string)
          The ID of the role that is assigned.
        - `organization_id` (string)
          The ID of the organization the role is scoped to.
        - `all` (boolean)
          When true, the role applies to all projects in the organization, otherwise the role is scoped to the projects specified in `project_ids`.
        - `project_ids` ([] string)
          The IDs of the projects the role is scoped to. Must be absent if `all` is true, and present if `all` is false.
        - `application_roles` ([] string)
          If provided, the user assigned this role assignment will be granted this application role when signing in to the project(s) specified in the role assignment.
      - `observability` ([] ProjectRoleAssignment)
        The Observability project-scoped role assignments to set
        - `role_id` (string)
          The ID of the role that is assigned.
        - `organization_id` (string)
          The ID of the organization the role is scoped to.
        - `all` (boolean)
          When true, the role applies to all projects in the organization, otherwise the role is scoped to the projects specified in `project_ids`.
        - `project_ids` ([] string)
          The IDs of the projects the role is scoped to. Must be absent if `all` is true, and present if `all` is false.
        - `application_roles` ([] string)
          If provided, the user assigned this role assignment will be granted this application role when signing in to the project(s) specified in the role assignment.
      - `security` ([] ProjectRoleAssignment)
        The Security project-scoped role assignments to set
        - `role_id` (string)
          The ID of the role that is assigned.
        - `organization_id` (string)
          The ID of the organization the role is scoped to.
        - `all` (boolean)
          When true, the role applies to all projects in the organization, otherwise the role is scoped to the projects specified in `project_ids`.
        - `project_ids` ([] string)
          The IDs of the projects the role is scoped to. Must be absent if `all` is true, and present if `all` is false.
        - `application_roles` ([] string)
          If provided, the user assigned this role assignment will be granted this application role when signing in to the project(s) specified in the role assignment.
      - `workplaceai` ([] ProjectRoleAssignment)
        The WorkplaceAI project-scoped role assignments to set
        - `role_id` (string)
          The ID of the role that is assigned.
        - `organization_id` (string)
          The ID of the organization the role is scoped to.
        - `all` (boolean)
          When true, the role applies to all projects in the organization, otherwise the role is scoped to the projects specified in `project_ids`.
        - `project_ids` ([] string)
          The IDs of the projects the role is scoped to. Must be absent if `all` is true, and present if `all` is false.
        - `application_roles` ([] string)
          If provided, the user assigned this role assignment will be granted this application role when signing in to the project(s) specified in the role assignment.
      - `vectordb` ([] ProjectRoleAssignment)
        The VectorDB project-scoped role assignments to set
        - `role_id` (string)
          The ID of the role that is assigned.
        - `organization_id` (string)
          The ID of the organization the role is scoped to.
        - `all` (boolean)
          When true, the role applies to all projects in the organization, otherwise the role is scoped to the projects specified in `project_ids`.
        - `project_ids` ([] string)
          The IDs of the projects the role is scoped to. Must be absent if `all` is true, and present if `all` is false.
        - `application_roles` ([] string)
          If provided, the user assigned this role assignment will be granted this application role when signing in to the project(s) specified in the role assignment.
- `next_page` (string)
  A cursor to get the next page of results
## Code Examples

#### Console

```console
GET /users/auth/keys
```

#### curl

```curl
curl -X GET "/users/auth/keys"
```