--- title: API Keys url: https://platform.claude.com/docs/en/api/csharp/beta/organization/api_keys --- # API Keys ## List API Keys `ApiKeyListPage Beta.Organization.ApiKeys.List(parameters, cancellationToken = default)` **GET** `/v1/organizations/api_keys` List API Keys ### Parameters - `ApiKeyListParams parameters` - `string afterID` (query parameter) ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately after this object. - `string beforeID` (query parameter) ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately before this object. - `string? createdByUserID` (query parameter) Filter by the ID of the User who created the object. - `long limit` (query parameter) Number of items to return per page. Defaults to `20`. Ranges from `1` to `1000`. minimum: 1, maximum: 1000 - `Status? status` (query parameter) Filter by API key status. - `Active("active")` - `Archived("archived")` - `Expired("expired")` - `Inactive("inactive")` - `string? workspaceID` (query parameter) Filter by Workspace ID. ### Returns - `class BetaApiKey` - `JsonElement Type = "api_key"` Object type. For API Keys, this is always `"api_key"`. - `required string ID` ID of the API key. - `required DateTimeOffset CreatedAt` RFC 3339 datetime string indicating when the API Key was created. format: date-time - `required BetaApiKeyCreatedBy? CreatedBy` The ID and type of the actor that created the API key, or `null` when the creator is not recorded (legacy, workload-identity-federated, or system-created keys). - `required Type Type` Type of the actor that created the object. - `ServiceAccount("service_account")` - `User("user")` - `required string ID` ID of the actor that created the object. - `required DateTimeOffset? ExpiresAt` RFC 3339 datetime string indicating when the API Key expires, or `null` if it never expires. format: date-time - `required string Name` Name of the API key. - `required string? PartialKeyHint` Partially redacted hint for the API key. - `required Principal? Principal` The principal the API key acts as (a User or a Service Account), or `null` if the API key is not bound to a principal. - `class BetaApiKeyUserActor` - `JsonElement Type = "user_actor"` Principal type. Always `"user_actor"` for a User. - `required string UserID` ID of the User the API key acts as. - `class BetaApiKeyServiceAccountActor` - `JsonElement Type = "service_account_actor"` Principal type. Always `"service_account_actor"` for a Service Account. - `required string ServiceAccountID` ID of the Service Account the API key acts as. - `required Scope Scope` Where the API key belongs: its Workspace (`{"type": "workspace", "workspace_id": "wrkspc_..."}`, with the Workspace's real ID even when it is the organization's default Workspace), or the organization (`{"type": "organization"}`) for a principal-bound API key that has no Workspace. - `class BetaApiKeyOrganizationScope` - `JsonElement Type = "organization"` Scope type. Always `"organization"`: the API key has no Workspace. Only a principal-bound API key can have this scope. - `class BetaApiKeyWorkspaceScope` - `JsonElement Type = "workspace"` Scope type. Always `"workspace"`: the API key belongs to one Workspace. - `required string WorkspaceID` ID of the Workspace the API key belongs to, including when it is the organization's default Workspace. - `required Status Status` Status of the API key. - `Active("active")` - `Archived("archived")` - `Expired("expired")` - `Inactive("inactive")` ### Example ```csharp using System; using Anthropic.Models.Beta.Organization.ApiKeys; ApiKeyListParams parameters = new(); var page = await client.Beta.Organization.ApiKeys.List(parameters); await foreach (var item in page.Paginate()) { Console.WriteLine(item); } ``` #### Response (200) ```json { "data": [ { "id": "apikey_01Rj2N8SVvo6BePZj99NhmiT", "created_at": "2024-10-30T23:58:27.427722Z", "created_by": { "id": "user_01WxYzAbCdEfGhJkMnPqRsTu", "type": "user" }, "expires_at": "2024-10-30T23:58:27.427722Z", "name": "Developer Key", "partial_key_hint": "sk-ant-api03-R2D...igAA", "principal": { "type": "user_actor", "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu" }, "scope": { "type": "workspace", "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ" }, "status": "active", "type": "api_key" } ], "first_id": "first_id", "has_more": true, "last_id": "last_id" } ``` ## Retrieve API Key (Admin API) `BetaApiKey Beta.Organization.ApiKeys.Retrieve(parameters, cancellationToken = default)` **GET** `/v1/organizations/api_keys/{api_key_id}` Retrieve information about a single API key in your organization, looked up by its ID. This Admin API endpoint requires an Admin API key, is intended for programmatic key management, and never returns the key's secret value. To view or create your own API keys, go to [API keys](https://platform.claude.com/settings/keys) in the Claude Console. ### Parameters - `ApiKeyRetrieveParams parameters` - `required string apiKeyID` (path parameter) ID of the API key. ### Returns - `class BetaApiKey` - `JsonElement Type = "api_key"` Object type. For API Keys, this is always `"api_key"`. - `required string ID` ID of the API key. - `required DateTimeOffset CreatedAt` RFC 3339 datetime string indicating when the API Key was created. format: date-time - `required BetaApiKeyCreatedBy? CreatedBy` The ID and type of the actor that created the API key, or `null` when the creator is not recorded (legacy, workload-identity-federated, or system-created keys). - `required Type Type` Type of the actor that created the object. - `ServiceAccount("service_account")` - `User("user")` - `required string ID` ID of the actor that created the object. - `required DateTimeOffset? ExpiresAt` RFC 3339 datetime string indicating when the API Key expires, or `null` if it never expires. format: date-time - `required string Name` Name of the API key. - `required string? PartialKeyHint` Partially redacted hint for the API key. - `required Principal? Principal` The principal the API key acts as (a User or a Service Account), or `null` if the API key is not bound to a principal. - `class BetaApiKeyUserActor` - `JsonElement Type = "user_actor"` Principal type. Always `"user_actor"` for a User. - `required string UserID` ID of the User the API key acts as. - `class BetaApiKeyServiceAccountActor` - `JsonElement Type = "service_account_actor"` Principal type. Always `"service_account_actor"` for a Service Account. - `required string ServiceAccountID` ID of the Service Account the API key acts as. - `required Scope Scope` Where the API key belongs: its Workspace (`{"type": "workspace", "workspace_id": "wrkspc_..."}`, with the Workspace's real ID even when it is the organization's default Workspace), or the organization (`{"type": "organization"}`) for a principal-bound API key that has no Workspace. - `class BetaApiKeyOrganizationScope` - `JsonElement Type = "organization"` Scope type. Always `"organization"`: the API key has no Workspace. Only a principal-bound API key can have this scope. - `class BetaApiKeyWorkspaceScope` - `JsonElement Type = "workspace"` Scope type. Always `"workspace"`: the API key belongs to one Workspace. - `required string WorkspaceID` ID of the Workspace the API key belongs to, including when it is the organization's default Workspace. - `required Status Status` Status of the API key. - `Active("active")` - `Archived("archived")` - `Expired("expired")` - `Inactive("inactive")` ### Example ```csharp using System; using Anthropic.Models.Beta.Organization.ApiKeys; ApiKeyRetrieveParams parameters = new() { ApiKeyID = "api_key_id" }; var betaApiKey = await client.Beta.Organization.ApiKeys.Retrieve(parameters); Console.WriteLine(betaApiKey); ``` #### Response (200) ```json { "id": "apikey_01Rj2N8SVvo6BePZj99NhmiT", "created_at": "2024-10-30T23:58:27.427722Z", "created_by": { "id": "user_01WxYzAbCdEfGhJkMnPqRsTu", "type": "user" }, "expires_at": "2024-10-30T23:58:27.427722Z", "name": "Developer Key", "partial_key_hint": "sk-ant-api03-R2D...igAA", "principal": { "type": "user_actor", "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu" }, "scope": { "type": "workspace", "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ" }, "status": "active", "type": "api_key" } ``` ## Update API Key `BetaApiKey Beta.Organization.ApiKeys.Update(parameters, cancellationToken = default)` **POST** `/v1/organizations/api_keys/{api_key_id}` Update API Key ### Parameters - `ApiKeyUpdateParams parameters` - `required string apiKeyID` (path parameter) ID of the API key. - `string? name` Name of the API key. minLength: 1, maxLength: 500 - `Status? status` Status of the API key. - `Active("active")` - `Archived("archived")` - `Inactive("inactive")` ### Returns - `class BetaApiKey` - `JsonElement Type = "api_key"` Object type. For API Keys, this is always `"api_key"`. - `required string ID` ID of the API key. - `required DateTimeOffset CreatedAt` RFC 3339 datetime string indicating when the API Key was created. format: date-time - `required BetaApiKeyCreatedBy? CreatedBy` The ID and type of the actor that created the API key, or `null` when the creator is not recorded (legacy, workload-identity-federated, or system-created keys). - `required Type Type` Type of the actor that created the object. - `ServiceAccount("service_account")` - `User("user")` - `required string ID` ID of the actor that created the object. - `required DateTimeOffset? ExpiresAt` RFC 3339 datetime string indicating when the API Key expires, or `null` if it never expires. format: date-time - `required string Name` Name of the API key. - `required string? PartialKeyHint` Partially redacted hint for the API key. - `required Principal? Principal` The principal the API key acts as (a User or a Service Account), or `null` if the API key is not bound to a principal. - `class BetaApiKeyUserActor` - `JsonElement Type = "user_actor"` Principal type. Always `"user_actor"` for a User. - `required string UserID` ID of the User the API key acts as. - `class BetaApiKeyServiceAccountActor` - `JsonElement Type = "service_account_actor"` Principal type. Always `"service_account_actor"` for a Service Account. - `required string ServiceAccountID` ID of the Service Account the API key acts as. - `required Scope Scope` Where the API key belongs: its Workspace (`{"type": "workspace", "workspace_id": "wrkspc_..."}`, with the Workspace's real ID even when it is the organization's default Workspace), or the organization (`{"type": "organization"}`) for a principal-bound API key that has no Workspace. - `class BetaApiKeyOrganizationScope` - `JsonElement Type = "organization"` Scope type. Always `"organization"`: the API key has no Workspace. Only a principal-bound API key can have this scope. - `class BetaApiKeyWorkspaceScope` - `JsonElement Type = "workspace"` Scope type. Always `"workspace"`: the API key belongs to one Workspace. - `required string WorkspaceID` ID of the Workspace the API key belongs to, including when it is the organization's default Workspace. - `required Status Status` Status of the API key. - `Active("active")` - `Archived("archived")` - `Expired("expired")` - `Inactive("inactive")` ### Example ```csharp using System; using Anthropic.Models.Beta.Organization.ApiKeys; ApiKeyUpdateParams parameters = new() { ApiKeyID = "api_key_id" }; var betaApiKey = await client.Beta.Organization.ApiKeys.Update(parameters); Console.WriteLine(betaApiKey); ``` #### Response (200) ```json { "id": "apikey_01Rj2N8SVvo6BePZj99NhmiT", "created_at": "2024-10-30T23:58:27.427722Z", "created_by": { "id": "user_01WxYzAbCdEfGhJkMnPqRsTu", "type": "user" }, "expires_at": "2024-10-30T23:58:27.427722Z", "name": "Developer Key", "partial_key_hint": "sk-ant-api03-R2D...igAA", "principal": { "type": "user_actor", "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu" }, "scope": { "type": "workspace", "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ" }, "status": "active", "type": "api_key" } ``` ## Domain types ### Beta API Key - `class BetaApiKey` - `JsonElement Type = "api_key"` Object type. For API Keys, this is always `"api_key"`. - `required string ID` ID of the API key. - `required DateTimeOffset CreatedAt` RFC 3339 datetime string indicating when the API Key was created. format: date-time - `required BetaApiKeyCreatedBy? CreatedBy` The ID and type of the actor that created the API key, or `null` when the creator is not recorded (legacy, workload-identity-federated, or system-created keys). - `required Type Type` Type of the actor that created the object. - `ServiceAccount("service_account")` - `User("user")` - `required string ID` ID of the actor that created the object. - `required DateTimeOffset? ExpiresAt` RFC 3339 datetime string indicating when the API Key expires, or `null` if it never expires. format: date-time - `required string Name` Name of the API key. - `required string? PartialKeyHint` Partially redacted hint for the API key. - `required Principal? Principal` The principal the API key acts as (a User or a Service Account), or `null` if the API key is not bound to a principal. - `class BetaApiKeyUserActor` - `JsonElement Type = "user_actor"` Principal type. Always `"user_actor"` for a User. - `required string UserID` ID of the User the API key acts as. - `class BetaApiKeyServiceAccountActor` - `JsonElement Type = "service_account_actor"` Principal type. Always `"service_account_actor"` for a Service Account. - `required string ServiceAccountID` ID of the Service Account the API key acts as. - `required Scope Scope` Where the API key belongs: its Workspace (`{"type": "workspace", "workspace_id": "wrkspc_..."}`, with the Workspace's real ID even when it is the organization's default Workspace), or the organization (`{"type": "organization"}`) for a principal-bound API key that has no Workspace. - `class BetaApiKeyOrganizationScope` - `JsonElement Type = "organization"` Scope type. Always `"organization"`: the API key has no Workspace. Only a principal-bound API key can have this scope. - `class BetaApiKeyWorkspaceScope` - `JsonElement Type = "workspace"` Scope type. Always `"workspace"`: the API key belongs to one Workspace. - `required string WorkspaceID` ID of the Workspace the API key belongs to, including when it is the organization's default Workspace. - `required Status Status` Status of the API key. - `Active("active")` - `Archived("archived")` - `Expired("expired")` - `Inactive("inactive")` ### Beta API Key Created By - `class BetaApiKeyCreatedBy` - `required Type Type` Type of the actor that created the object. - `ServiceAccount("service_account")` - `User("user")` - `required string ID` ID of the actor that created the object. ### Beta API Key Organization Scope - `class BetaApiKeyOrganizationScope` - `JsonElement Type = "organization"` Scope type. Always `"organization"`: the API key has no Workspace. Only a principal-bound API key can have this scope. ### Beta API Key Service Account Actor - `class BetaApiKeyServiceAccountActor` - `JsonElement Type = "service_account_actor"` Principal type. Always `"service_account_actor"` for a Service Account. - `required string ServiceAccountID` ID of the Service Account the API key acts as. ### Beta API Key User Actor - `class BetaApiKeyUserActor` - `JsonElement Type = "user_actor"` Principal type. Always `"user_actor"` for a User. - `required string UserID` ID of the User the API key acts as. ### Beta API Key Workspace Scope - `class BetaApiKeyWorkspaceScope` - `JsonElement Type = "workspace"` Scope type. Always `"workspace"`: the API key belongs to one Workspace. - `required string WorkspaceID` ID of the Workspace the API key belongs to, including when it is the organization's default Workspace.