Skip to main content
GET
JavaScript

Authorizations

Authorization
string
header
required

A company API key, company scoped JWT, app API key, or user OAuth token. You must prepend your key/token with the word 'Bearer', which will look like Bearer ***************************

Headers

Api-Version-Date
string

Pins the request to a dated API version.

Example:

"2026-07-20"

Path Parameters

id
string
required

API key ID, prefixed apik_.

Response

api key retrieved with grants but never the secret

created_at
string
required

When the API key was created, as an ISO 8601 timestamp.

expires_at
string | null
required

When the API key stops working, as an ISO 8601 timestamp. null means it never expires.

id
string
required

API key ID, prefixed apik_.

ip_allowlist
string[] | null
required

IPv4/IPv6 CIDR ranges allowed to use this key. null or empty means requests are accepted from any IP.

is_default_for_resource
boolean
required

Whether this is the resource's default API key. Default keys cannot be updated or deleted, only rotated.

name
string | null
required

Human-readable name identifying the API key, or null when none was set.

obfuscated_secret_key
string
required

Masked version of the secret key, so the key can be recognized without revealing the full secret.

system_role
enum<string> | null
required

System role the key inherits its permissions from, or null when it uses an explicit permissions policy. Only account API keys can use a system role.

Available options:
owner,
admin,
moderator,
sales_manager,
advertiser,
null
Example:

"owner"

updated_at
string
required

When the API key was last updated, as an ISO 8601 timestamp.

grants
object[]
secret_key
string

The full secret used to authenticate requests. Returned only once, on create and rotate responses — store it immediately.