--- title: API Keys url: https://platform.claude.com/docs/en/api/go/organization/api_keys --- # API Keys ## List API Keys `client.Organization.APIKeys.List(ctx, query) (*Page[APIKey], error)` **GET** `/v1/organizations/api_keys` List API Keys ### Parameters - `query OrganizationAPIKeyListParams` - `AfterID param.Opt[string] Optional` (query parameter) ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately after this object. - `BeforeID param.Opt[string] Optional` (query parameter) ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately before this object. - `CreatedByUserID param.Opt[string] Optional` (query parameter) Filter by the ID of the User who created the object. - `Limit param.Opt[int64] Optional` (query parameter) Number of items to return per page. Defaults to `20`. Ranges from `1` to `1000`. minimum: 1, maximum: 1000 - `Status OrganizationAPIKeyListParamsStatus Optional` (query parameter) Filter by API key status. - `const OrganizationAPIKeyListParamsStatusActive OrganizationAPIKeyListParamsStatus = "active"` - `const OrganizationAPIKeyListParamsStatusArchived OrganizationAPIKeyListParamsStatus = "archived"` - `const OrganizationAPIKeyListParamsStatusExpired OrganizationAPIKeyListParamsStatus = "expired"` - `const OrganizationAPIKeyListParamsStatusInactive OrganizationAPIKeyListParamsStatus = "inactive"` - `WorkspaceID param.Opt[string] Optional` (query parameter) Filter by Workspace ID. ### Returns - `type APIKey` - `Type APIKey` Object type. For API Keys, this is always `"api_key"`. default: api_key - `ID string` ID of the API key. - `CreatedAt Time` RFC 3339 datetime string indicating when the API Key was created. format: date-time - `CreatedBy APIKeyCreatedBy` The ID and type of the actor that created the API key, or `null` when the creator is not recorded (legacy, workload-identity-federated, or system-created keys). - `Type APIKeyCreatedByType` Type of the actor that created the object. - `const APIKeyCreatedByTypeServiceAccount APIKeyCreatedByType = "service_account"` - `const APIKeyCreatedByTypeUser APIKeyCreatedByType = "user"` - `ID string` ID of the actor that created the object. - `ExpiresAt Time` RFC 3339 datetime string indicating when the API Key expires, or `null` if it never expires. format: date-time - `Name string` Name of the API key. - `PartialKeyHint string` Partially redacted hint for the API key. - `Principal APIKeyPrincipalUnion` The principal the API key acts as (a User or a Service Account), or `null` if the API key is not bound to a principal. - `type APIKeyUserActor` - `Type UserActor` Principal type. Always `"user_actor"` for a User. default: user_actor - `UserID string` ID of the User the API key acts as. - `type APIKeyServiceAccountActor` - `Type ServiceAccountActor` Principal type. Always `"service_account_actor"` for a Service Account. default: service_account_actor - `ServiceAccountID string` ID of the Service Account the API key acts as. - `Scope APIKeyScopeUnion` Where the API key belongs: its Workspace (`{"type": "workspace", "workspace_id": "wrkspc_..."}`, with the Workspace's real ID even when it is the organization's default Workspace), or the organization (`{"type": "organization"}`) for a principal-bound API key that has no Workspace. - `type APIKeyOrganizationScope` - `Type Organization` Scope type. Always `"organization"`: the API key has no Workspace. Only a principal-bound API key can have this scope. default: organization - `type APIKeyWorkspaceScope` - `Type Workspace` Scope type. Always `"workspace"`: the API key belongs to one Workspace. default: workspace - `WorkspaceID string` ID of the Workspace the API key belongs to. Unlike the deprecated top-level `workspace_id`, this is the Workspace's real ID even for the organization's default Workspace. - `Status APIKeyStatus` Status of the API key. - `const APIKeyStatusActive APIKeyStatus = "active"` - `const APIKeyStatusArchived APIKeyStatus = "archived"` - `const APIKeyStatusExpired APIKeyStatus = "expired"` - `const APIKeyStatusInactive APIKeyStatus = "inactive"` ### Example ```go package main import ( "context" "fmt" "github.com/anthropics/anthropic-sdk-go" "github.com/anthropics/anthropic-sdk-go/option" ) func main() { client := anthropic.NewClient( option.WithAPIKey("my-anthropic-api-key"), ) page, err := client.Organization.APIKeys.List(context.TODO(), anthropic.OrganizationAPIKeyListParams{}) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", page) } ``` #### Response (200) ```json { "data": [ { "id": "apikey_01Rj2N8SVvo6BePZj99NhmiT", "created_at": "2024-10-30T23:58:27.427722Z", "created_by": { "id": "user_01WCz1FkmYMm4gnmykNKUu3Q", "type": "user" }, "expires_at": "2024-10-30T23:58:27.427722Z", "name": "Developer Key", "partial_key_hint": "sk-ant-api03-R2D...igAA", "principal": { "type": "user_actor", "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q" }, "scope": { "type": "workspace", "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ" }, "status": "active", "type": "api_key", "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ" } ], "first_id": "first_id", "has_more": true, "last_id": "last_id" } ``` ## Retrieve API Key (Admin API) `client.Organization.APIKeys.Get(ctx, apiKeyID) (*APIKey, error)` **GET** `/v1/organizations/api_keys/{api_key_id}` Retrieve information about a single API key in your organization, looked up by its ID. This Admin API endpoint requires an Admin API key, is intended for programmatic key management, and never returns the key's secret value. To view or create your own API keys, go to [API keys](https://platform.claude.com/settings/keys) in the Claude Console. ### Parameters - `apiKeyID string` (path parameter) ID of the API key. ### Returns - `type APIKey` - `Type APIKey` Object type. For API Keys, this is always `"api_key"`. default: api_key - `ID string` ID of the API key. - `CreatedAt Time` RFC 3339 datetime string indicating when the API Key was created. format: date-time - `CreatedBy APIKeyCreatedBy` The ID and type of the actor that created the API key, or `null` when the creator is not recorded (legacy, workload-identity-federated, or system-created keys). - `Type APIKeyCreatedByType` Type of the actor that created the object. - `const APIKeyCreatedByTypeServiceAccount APIKeyCreatedByType = "service_account"` - `const APIKeyCreatedByTypeUser APIKeyCreatedByType = "user"` - `ID string` ID of the actor that created the object. - `ExpiresAt Time` RFC 3339 datetime string indicating when the API Key expires, or `null` if it never expires. format: date-time - `Name string` Name of the API key. - `PartialKeyHint string` Partially redacted hint for the API key. - `Principal APIKeyPrincipalUnion` The principal the API key acts as (a User or a Service Account), or `null` if the API key is not bound to a principal. - `type APIKeyUserActor` - `Type UserActor` Principal type. Always `"user_actor"` for a User. default: user_actor - `UserID string` ID of the User the API key acts as. - `type APIKeyServiceAccountActor` - `Type ServiceAccountActor` Principal type. Always `"service_account_actor"` for a Service Account. default: service_account_actor - `ServiceAccountID string` ID of the Service Account the API key acts as. - `Scope APIKeyScopeUnion` Where the API key belongs: its Workspace (`{"type": "workspace", "workspace_id": "wrkspc_..."}`, with the Workspace's real ID even when it is the organization's default Workspace), or the organization (`{"type": "organization"}`) for a principal-bound API key that has no Workspace. - `type APIKeyOrganizationScope` - `Type Organization` Scope type. Always `"organization"`: the API key has no Workspace. Only a principal-bound API key can have this scope. default: organization - `type APIKeyWorkspaceScope` - `Type Workspace` Scope type. Always `"workspace"`: the API key belongs to one Workspace. default: workspace - `WorkspaceID string` ID of the Workspace the API key belongs to. Unlike the deprecated top-level `workspace_id`, this is the Workspace's real ID even for the organization's default Workspace. - `Status APIKeyStatus` Status of the API key. - `const APIKeyStatusActive APIKeyStatus = "active"` - `const APIKeyStatusArchived APIKeyStatus = "archived"` - `const APIKeyStatusExpired APIKeyStatus = "expired"` - `const APIKeyStatusInactive APIKeyStatus = "inactive"` ### Example ```go package main import ( "context" "fmt" "github.com/anthropics/anthropic-sdk-go" "github.com/anthropics/anthropic-sdk-go/option" ) func main() { client := anthropic.NewClient( option.WithAPIKey("my-anthropic-api-key"), ) apiKey, err := client.Organization.APIKeys.Get(context.TODO(), "api_key_id") if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", apiKey.ID) } ``` #### Response (200) ```json { "id": "apikey_01Rj2N8SVvo6BePZj99NhmiT", "created_at": "2024-10-30T23:58:27.427722Z", "created_by": { "id": "user_01WCz1FkmYMm4gnmykNKUu3Q", "type": "user" }, "expires_at": "2024-10-30T23:58:27.427722Z", "name": "Developer Key", "partial_key_hint": "sk-ant-api03-R2D...igAA", "principal": { "type": "user_actor", "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q" }, "scope": { "type": "workspace", "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ" }, "status": "active", "type": "api_key", "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ" } ``` ## Update API Key `client.Organization.APIKeys.Update(ctx, apiKeyID, body) (*APIKey, error)` **POST** `/v1/organizations/api_keys/{api_key_id}` Update API Key ### Parameters - `apiKeyID string` (path parameter) ID of the API key. - `body OrganizationAPIKeyUpdateParams` - `Name param.Opt[string] Optional` Name of the API key. minLength: 1, maxLength: 500 - `Status OrganizationAPIKeyUpdateParamsStatus Optional` Status of the API key. - `const OrganizationAPIKeyUpdateParamsStatusActive OrganizationAPIKeyUpdateParamsStatus = "active"` - `const OrganizationAPIKeyUpdateParamsStatusArchived OrganizationAPIKeyUpdateParamsStatus = "archived"` - `const OrganizationAPIKeyUpdateParamsStatusInactive OrganizationAPIKeyUpdateParamsStatus = "inactive"` ### Returns - `type APIKey` - `Type APIKey` Object type. For API Keys, this is always `"api_key"`. default: api_key - `ID string` ID of the API key. - `CreatedAt Time` RFC 3339 datetime string indicating when the API Key was created. format: date-time - `CreatedBy APIKeyCreatedBy` The ID and type of the actor that created the API key, or `null` when the creator is not recorded (legacy, workload-identity-federated, or system-created keys). - `Type APIKeyCreatedByType` Type of the actor that created the object. - `const APIKeyCreatedByTypeServiceAccount APIKeyCreatedByType = "service_account"` - `const APIKeyCreatedByTypeUser APIKeyCreatedByType = "user"` - `ID string` ID of the actor that created the object. - `ExpiresAt Time` RFC 3339 datetime string indicating when the API Key expires, or `null` if it never expires. format: date-time - `Name string` Name of the API key. - `PartialKeyHint string` Partially redacted hint for the API key. - `Principal APIKeyPrincipalUnion` The principal the API key acts as (a User or a Service Account), or `null` if the API key is not bound to a principal. - `type APIKeyUserActor` - `Type UserActor` Principal type. Always `"user_actor"` for a User. default: user_actor - `UserID string` ID of the User the API key acts as. - `type APIKeyServiceAccountActor` - `Type ServiceAccountActor` Principal type. Always `"service_account_actor"` for a Service Account. default: service_account_actor - `ServiceAccountID string` ID of the Service Account the API key acts as. - `Scope APIKeyScopeUnion` Where the API key belongs: its Workspace (`{"type": "workspace", "workspace_id": "wrkspc_..."}`, with the Workspace's real ID even when it is the organization's default Workspace), or the organization (`{"type": "organization"}`) for a principal-bound API key that has no Workspace. - `type APIKeyOrganizationScope` - `Type Organization` Scope type. Always `"organization"`: the API key has no Workspace. Only a principal-bound API key can have this scope. default: organization - `type APIKeyWorkspaceScope` - `Type Workspace` Scope type. Always `"workspace"`: the API key belongs to one Workspace. default: workspace - `WorkspaceID string` ID of the Workspace the API key belongs to. Unlike the deprecated top-level `workspace_id`, this is the Workspace's real ID even for the organization's default Workspace. - `Status APIKeyStatus` Status of the API key. - `const APIKeyStatusActive APIKeyStatus = "active"` - `const APIKeyStatusArchived APIKeyStatus = "archived"` - `const APIKeyStatusExpired APIKeyStatus = "expired"` - `const APIKeyStatusInactive APIKeyStatus = "inactive"` ### Example ```go package main import ( "context" "fmt" "github.com/anthropics/anthropic-sdk-go" "github.com/anthropics/anthropic-sdk-go/option" ) func main() { client := anthropic.NewClient( option.WithAPIKey("my-anthropic-api-key"), ) apiKey, err := client.Organization.APIKeys.Update( context.TODO(), "api_key_id", anthropic.OrganizationAPIKeyUpdateParams{}, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", apiKey.ID) } ``` #### Response (200) ```json { "id": "apikey_01Rj2N8SVvo6BePZj99NhmiT", "created_at": "2024-10-30T23:58:27.427722Z", "created_by": { "id": "user_01WCz1FkmYMm4gnmykNKUu3Q", "type": "user" }, "expires_at": "2024-10-30T23:58:27.427722Z", "name": "Developer Key", "partial_key_hint": "sk-ant-api03-R2D...igAA", "principal": { "type": "user_actor", "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q" }, "scope": { "type": "workspace", "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ" }, "status": "active", "type": "api_key", "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ" } ``` ## Domain types ### API Key - `type APIKey` - `Type APIKey` Object type. For API Keys, this is always `"api_key"`. default: api_key - `ID string` ID of the API key. - `CreatedAt Time` RFC 3339 datetime string indicating when the API Key was created. format: date-time - `CreatedBy APIKeyCreatedBy` The ID and type of the actor that created the API key, or `null` when the creator is not recorded (legacy, workload-identity-federated, or system-created keys). - `Type APIKeyCreatedByType` Type of the actor that created the object. - `const APIKeyCreatedByTypeServiceAccount APIKeyCreatedByType = "service_account"` - `const APIKeyCreatedByTypeUser APIKeyCreatedByType = "user"` - `ID string` ID of the actor that created the object. - `ExpiresAt Time` RFC 3339 datetime string indicating when the API Key expires, or `null` if it never expires. format: date-time - `Name string` Name of the API key. - `PartialKeyHint string` Partially redacted hint for the API key. - `Principal APIKeyPrincipalUnion` The principal the API key acts as (a User or a Service Account), or `null` if the API key is not bound to a principal. - `type APIKeyUserActor` - `Type UserActor` Principal type. Always `"user_actor"` for a User. default: user_actor - `UserID string` ID of the User the API key acts as. - `type APIKeyServiceAccountActor` - `Type ServiceAccountActor` Principal type. Always `"service_account_actor"` for a Service Account. default: service_account_actor - `ServiceAccountID string` ID of the Service Account the API key acts as. - `Scope APIKeyScopeUnion` Where the API key belongs: its Workspace (`{"type": "workspace", "workspace_id": "wrkspc_..."}`, with the Workspace's real ID even when it is the organization's default Workspace), or the organization (`{"type": "organization"}`) for a principal-bound API key that has no Workspace. - `type APIKeyOrganizationScope` - `Type Organization` Scope type. Always `"organization"`: the API key has no Workspace. Only a principal-bound API key can have this scope. default: organization - `type APIKeyWorkspaceScope` - `Type Workspace` Scope type. Always `"workspace"`: the API key belongs to one Workspace. default: workspace - `WorkspaceID string` ID of the Workspace the API key belongs to. Unlike the deprecated top-level `workspace_id`, this is the Workspace's real ID even for the organization's default Workspace. - `Status APIKeyStatus` Status of the API key. - `const APIKeyStatusActive APIKeyStatus = "active"` - `const APIKeyStatusArchived APIKeyStatus = "archived"` - `const APIKeyStatusExpired APIKeyStatus = "expired"` - `const APIKeyStatusInactive APIKeyStatus = "inactive"` ### API Key Created By - `type APIKeyCreatedBy` - `Type APIKeyCreatedByType` Type of the actor that created the object. - `const APIKeyCreatedByTypeServiceAccount APIKeyCreatedByType = "service_account"` - `const APIKeyCreatedByTypeUser APIKeyCreatedByType = "user"` - `ID string` ID of the actor that created the object. ### API Key Organization Scope - `type APIKeyOrganizationScope` - `Type Organization` Scope type. Always `"organization"`: the API key has no Workspace. Only a principal-bound API key can have this scope. default: organization ### API Key Service Account Actor - `type APIKeyServiceAccountActor` - `Type ServiceAccountActor` Principal type. Always `"service_account_actor"` for a Service Account. default: service_account_actor - `ServiceAccountID string` ID of the Service Account the API key acts as. ### API Key User Actor - `type APIKeyUserActor` - `Type UserActor` Principal type. Always `"user_actor"` for a User. default: user_actor - `UserID string` ID of the User the API key acts as. ### API Key Workspace Scope - `type APIKeyWorkspaceScope` - `Type Workspace` Scope type. Always `"workspace"`: the API key belongs to one Workspace. default: workspace - `WorkspaceID string` ID of the Workspace the API key belongs to. Unlike the deprecated top-level `workspace_id`, this is the Workspace's real ID even for the organization's default Workspace.