> ## Documentation Index > Fetch the complete documentation index at: https://docs.checkfu.com/llms.txt > Use this file to discover all available pages before exploring further. # Get an API key > Reads one ApiKey issued by the authenticated Organization, including its role, scope, kind, rate limit, runner enrollment, resource_version, and… ## OpenAPI ````yaml /openapi.json get /v1/api-keys/{id} openapi: 3.1.0 info: title: Checkfu API version: '2026-08-31' description: >- Authentication is declared per operation: API-key, runtime, or connector bearer; Automation signature; or credential-free pairing redemption. Every general Checkfu REST request requires the dated `Checkfu-Version` header (one of: 2026-08-31); the three MCP JSON-RPC transports use `MCP-Protocol-Version`, A2A uses `A2A-Version`, and the provider OAuth callback carries neither Checkfu header. API keys resolve one Workspace without a request selector; authenticated responses identify it with `Checkfu-Workspace-Id`. servers: - url: https://api.checkfu.com security: - bearerAuth: [] tags: - name: organizations - name: sourceRepositories - name: tenants - name: workspaces - name: principals - name: principalGroups - name: principalAccessCredentials - name: apiKeys - name: agents - name: harnessRuntime - name: permissionAssignments - name: actionPolicies - name: files - name: memoryStores - name: modelCredentials - name: modelRoutingProfiles - name: toolSources - name: skills - name: skillSources - name: agentBlueprints - name: skillProposals - name: instructionProposals - name: catalog - name: managedTools - name: concepts - name: support - name: connections - name: connectionVaults - name: connectionAssignments - name: connectedRuntimes - name: fileTrees - name: collaboration - name: automationGraphs - name: automations - name: actionApprovals - name: standingApprovals - name: workloadReviewPolicies - name: usage - name: models - name: outcomes - name: budgets - name: billing - name: sessions - name: audit - name: sessionExports - name: runs - name: runnerPools - name: transcripts - name: sessionWatches - name: sessionCapsules - name: sessionTrajectories - name: webhookEndpoints - name: integrationGateway - name: workEnvironments - name: computers - name: computerScreens - name: computerBrowserObservations - name: computerBrowserActions - name: environments - name: computerHeadlessOperations - name: vaults - name: apiMcp - name: a2a paths: /v1/api-keys/{id}: get: tags: - apiKeys summary: Get an API key description: >- Reads one ApiKey issued by the authenticated Organization, including its role, scope, `kind`, rate limit, runner enrollment, `resource_version`, and `revoked_at`. The secret is never returned. Use the returned `resource_version` as `expected_resource_version` when patching or rotating. Checkfu support posture: alpha; hosted. Required evidence journey: tenant-control. Deployment-specific readiness and the latest proven release are available from GET /v1/support/capabilities. operationId: apiKeys.getApiKey parameters: - name: id in: path schema: $ref: '#/components/schemas/ApiKeyId' required: true - name: checkfu-version in: header schema: type: string enum: - '2026-08-31' required: true responses: '200': description: Success content: application/json: schema: $ref: '#/components/schemas/Objects_10' headers: checkfu-workspace-id: description: The Workspace resolved from the authenticated bearer credential. required: true schema: $ref: '#/components/schemas/WorkspaceId' '400': description: Typed Checkfu wire error content: application/json: schema: type: object required: - error properties: error: type: object properties: type: type: string enum: - validation.malformed message: type: string more: type: string enum: - >- https://docs.checkfu.com/reference/errors#validation-malformed description: >- Stable public documentation and remedy for this error type. required: - type - message - more additionalProperties: false additionalProperties: false '401': description: Typed Checkfu wire error content: application/json: schema: type: object required: - error properties: error: type: object required: - type - message - more properties: type: type: string enum: - auth.invalid_key message: type: string more: type: string enum: - >- https://docs.checkfu.com/reference/errors#auth-invalid-key description: >- Stable public documentation and remedy for this error type. additionalProperties: false additionalProperties: false '403': description: >- The organization, tenant, or workspace backing this key is administratively disabled. | Deployment governance or retention policy denied the request. content: application/json: schema: anyOf: - type: object required: - error properties: error: type: object properties: type: type: string enum: - auth.disabled_tenancy message: type: string more: type: string enum: - >- https://docs.checkfu.com/reference/errors#auth-disabled-tenancy description: >- Stable public documentation and remedy for this error type. required: - type - message - more additionalProperties: false additionalProperties: false - $ref: '#/components/schemas/PolicyDeniedError' '404': description: >- The requested resource does not exist in the resolved deployment boundary. content: application/json: schema: $ref: '#/components/schemas/ValidationNotFoundError' '429': description: Typed Checkfu wire error headers: retry-after: description: >- Delay in seconds for rate limits or deployment quotas with a known release or UTC reset boundary required: false schema: type: integer minimum: 1 content: application/json: schema: type: object required: - error properties: error: type: object required: - type - message - more properties: type: type: string enum: - budget.exceeded message: type: string more: type: string enum: - >- https://docs.checkfu.com/reference/errors#budget-exceeded description: >- Stable public documentation and remedy for this error type. additionalProperties: false additionalProperties: false '500': description: >- An unexpected internal failure occurred; the message contains an opaque incident reference. content: application/json: schema: $ref: '#/components/schemas/RuntimeInternalError' '503': description: Authorization could not be evaluated. Retry the same request. content: application/json: schema: $ref: '#/components/schemas/AuthorizationUnavailableError' security: - bearerAuth: [] components: schemas: ApiKeyId: type: string pattern: ^akey_[0-9a-f]{32}$ Objects_10: type: object properties: expires_at: $ref: '#/components/schemas/CurrentTimestamp' id: $ref: '#/components/schemas/ApiKeyId' organization_id: $ref: '#/components/schemas/OrganizationId' display_name: type: string allOf: - minLength: 1 - maxLength: 255 role: $ref: '#/components/schemas/Union_15' scope: $ref: '#/components/schemas/Union_16' api_key_type: type: string enum: - organization_managed - console_session rate_limit_per_minute: type: integer allOf: - exclusiveMinimum: 0 - maximum: 2147483647 runner_enrollment: anyOf: - type: object properties: placement: $ref: '#/components/schemas/Union_18' providers: $ref: '#/components/schemas/Arrays_1' plane_protocols: $ref: '#/components/schemas/Arrays_2' runner_pool: $ref: '#/components/schemas/RunnerPoolId' owner: type: object properties: principal: $ref: '#/components/schemas/PrincipalId' machine_label: type: string allOf: - minLength: 1 - maxLength: 120 required: - principal additionalProperties: false leaf: $ref: '#/components/schemas/RunnerEnrollmentLeaf' placement_conformance_digests: $ref: '#/components/schemas/Arrays_3' required: - placement - providers - plane_protocols additionalProperties: false - type: 'null' resource_version: type: integer allOf: - exclusiveMinimum: 0 - maximum: 9007199254740991 created_at: type: string updated_at: type: string revoked_at: anyOf: - type: string - type: 'null' required: - id - organization_id - display_name - role - scope - api_key_type - rate_limit_per_minute - runner_enrollment - resource_version - created_at - updated_at - revoked_at additionalProperties: false WorkspaceId: type: string pattern: ^wrkspc_[0-9a-f]{32}$ PolicyDeniedError: type: object properties: error: type: object properties: type: type: string enum: - policy.denied message: type: string more: type: string enum: - https://docs.checkfu.com/reference/errors#policy-denied description: Stable public documentation and remedy for this error type. required: - type - message - more additionalProperties: false required: - error additionalProperties: false description: Deployment governance or retention policy denied the request. ValidationNotFoundError: type: object properties: error: type: object properties: type: type: string enum: - validation.not_found message: type: string more: type: string enum: - https://docs.checkfu.com/reference/errors#validation-not-found description: Stable public documentation and remedy for this error type. required: - type - message - more additionalProperties: false required: - error additionalProperties: false description: >- The requested resource does not exist in the resolved deployment boundary. RuntimeInternalError: type: object properties: error: type: object properties: type: type: string enum: - runtime.internal message: type: string more: type: string enum: - https://docs.checkfu.com/reference/errors#runtime-internal description: Stable public documentation and remedy for this error type. required: - type - message - more additionalProperties: false required: - error additionalProperties: false description: >- An unexpected internal failure occurred; the message contains an opaque incident reference. AuthorizationUnavailableError: type: object properties: error: type: object properties: type: type: string enum: - auth.authorization_unavailable message: type: string more: type: string enum: - >- https://docs.checkfu.com/reference/errors#auth-authorization-unavailable description: Stable public documentation and remedy for this error type. required: - type - message - more additionalProperties: false required: - error additionalProperties: false description: Authorization could not be evaluated. Retry the same request. CurrentTimestamp: type: string allOf: - maxLength: 24 - pattern: ^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$ x-checkfu-current-timestamp: true description: A canonical UTC ISO-8601 timestamp with millisecond precision. OrganizationId: type: string pattern: ^org_[0-9a-f]{32}$ Union_15: type: string enum: - root - admin - developer - runner - viewer Union_16: anyOf: - type: object properties: type: type: string enum: - organization required: - type additionalProperties: false - type: object properties: type: type: string enum: - workspace workspace_id: $ref: '#/components/schemas/WorkspaceId' required: - type - workspace_id additionalProperties: false Union_18: type: string enum: - local - hosted - byoc Arrays_1: type: array items: $ref: '#/components/schemas/Objects_6' allOf: - minItems: 1 - maxItems: 64 Arrays_2: type: array items: $ref: '#/components/schemas/Union_21' allOf: - maxItems: 16 RunnerPoolId: type: string pattern: ^rpool_[0-9a-f]{32}$ PrincipalId: type: string pattern: ^prin_[0-9a-f]{32}$ RunnerEnrollmentLeaf: type: object properties: session_id: $ref: '#/components/schemas/SessionId' session_sandbox_id: $ref: '#/components/schemas/SessionSandboxId' allocation_generation: type: integer exclusiveMinimum: 0 boot_epoch: type: integer minimum: 0 required: - session_id additionalProperties: false description: >- The Session a leaf Runner credential is bound to. The credential claims only this Session's work. Arrays_3: type: array items: type: string pattern: ^sha256:[0-9a-f]{64}$ allOf: - maxItems: 256 Objects_6: type: object properties: id: type: string allOf: - minLength: 1 - maxLength: 255 provider_revision: type: string allOf: - minLength: 1 - maxLength: 255 materialization_revision: type: string allOf: - minLength: 1 - maxLength: 255 browser_observation: $ref: '#/components/schemas/BrowserProviderObservationCapabilities' desktop_observation: $ref: '#/components/schemas/DesktopProviderObservationCapabilities' headless_operations: type: array items: type: string enum: - filesystem_read - filesystem_list - filesystem_write - filesystem_remove - process_start - process_inspect - process_signal allOf: - minItems: 1 - maxItems: 7 drivers: type: array items: type: string allOf: - minLength: 1 - maxLength: 255 allOf: - minItems: 1 - maxItems: 256 harness_owned_models: type: array items: type: object properties: kind: type: string enum: - cursor_api_key harness_profile_id: $ref: '#/components/schemas/HarnessProfileId' harness_profile_version_number: type: integer exclusiveMinimum: 0 harness_release_digest: type: string pattern: ^sha256:[0-9a-f]{64}$ provider: type: string enum: - cursor model: type: string allOf: - minLength: 1 - maxLength: 255 required: - kind - harness_profile_id - harness_profile_version_number - harness_release_digest - provider - model additionalProperties: false allOf: - maxItems: 64 launch_kinds: type: array items: type: string enum: - trusted - oci allOf: - minItems: 1 tiers: type: array items: type: string enum: - container - microvm allOf: - minItems: 1 platforms: type: array items: $ref: '#/components/schemas/Objects_7' allOf: - minItems: 1 network_modes: type: array items: $ref: '#/components/schemas/Union_19' allOf: - minItems: 1 retention_modes: type: array items: $ref: '#/components/schemas/Union_20' allOf: - minItems: 1 session_sandbox: type: boolean managed_sandbox_retention: type: boolean runtime_assurances: $ref: '#/components/schemas/Objects_8' acp_transport: type: string enum: - stdio - stdio-tunnel - network snapshot_clone: type: boolean snapshot_custody: type: string enum: - runner - provider package_materialization: type: boolean max_mounts: type: integer minimum: 0 mount_kinds: type: array items: type: string enum: - uploaded_file_tree - git - memory - skills - file allOf: - maxItems: 5 minimum_resources: $ref: '#/components/schemas/Objects_9' maximum_resources: $ref: '#/components/schemas/Objects_9' required: - id - provider_revision - materialization_revision - drivers - launch_kinds - tiers - platforms - network_modes - retention_modes - package_materialization - max_mounts - minimum_resources - maximum_resources additionalProperties: false Union_21: type: string enum: - model-gateway-v1 - platform-mcp-v1 - platform-control-mcp-v2 - computer-session-tools-v1 SessionId: type: string pattern: ^sess_[0-9a-f]{32}$ SessionSandboxId: type: string pattern: ^ssbx_[0-9a-f]{32}$ BrowserProviderObservationCapabilities: type: object properties: accessibility_tree: type: boolean screenshot: type: boolean required: - accessibility_tree - screenshot additionalProperties: false DesktopProviderObservationCapabilities: type: object properties: accessibility_tree: type: boolean screenshot: type: boolean window_inventory: type: boolean required: - accessibility_tree - screenshot - window_inventory additionalProperties: false HarnessProfileId: type: string pattern: ^hprof_[0-9a-f]{32}$ Objects_7: type: object properties: os: type: string enum: - linux architecture: type: string enum: - amd64 - arm64 required: - os - architecture additionalProperties: false Union_19: type: string enum: - none - allowlist - unrestricted Union_20: type: string enum: - durable - ephemeral_zdr Objects_8: type: object properties: compute_accounting: type: boolean network_isolation: type: boolean bounded_start: type: boolean bounded_cancel: type: boolean teardown: type: boolean required: - compute_accounting - network_isolation - bounded_start - bounded_cancel - teardown additionalProperties: false Objects_9: type: object properties: cpu_millis: type: integer exclusiveMinimum: 0 memory_mib: type: integer exclusiveMinimum: 0 disk_mib: type: integer exclusiveMinimum: 0 max_duration_seconds: type: integer exclusiveMinimum: 0 required: - cpu_millis - memory_mib - disk_mib - max_duration_seconds additionalProperties: false securitySchemes: bearerAuth: type: http scheme: bearer ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.